Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
BraveBrowserSetup-BRV002.exe

Overview

General Information

Sample name:BraveBrowserSetup-BRV002.exe
Analysis ID:1408821
MD5:e3e7498c2436a1570109fbe755af1d40
SHA1:d7fb79f465d2c87ef22088327b5bfb73899fdf7e
SHA256:498e27ed4e5bb584672992f459c0e51cd1e7345889dff1521ccf577b13ed6313
Infos:

Detection

Score:51
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:47
Range:0 - 100

Signatures

Benign windows process drops PE files
Creates an undocumented autostart registry key
Downloads suspicious files via Chrome
Found evasive API chain (may stop execution after checking volume information)
Found evasive API chain checking for user administrative privileges
Maps a DLL or memory area into another process
Changes image file execution options
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Disables exception chain validation (SEHOP)
Drops PE files
Enables debug privileges
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain (may stop execution after checking a module file name)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Potential browser exploit detected (process start blacklist hit)
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Use Short Name Path in Command Line
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • BraveBrowserSetup-BRV002.exe (PID: 6968 cmdline: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe MD5: E3E7498C2436A1570109FBE755AF1D40)
    • BraveUpdate.exe (PID: 7036 cmdline: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
      • BraveUpdate.exe (PID: 6260 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
      • BraveUpdate.exe (PID: 6320 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
        • BraveUpdateComRegisterShell64.exe (PID: 3484 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe" MD5: F2CA542F38E6B51EDB9790369117F54A)
        • BraveUpdateComRegisterShell64.exe (PID: 2736 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe" MD5: F2CA542F38E6B51EDB9790369117F54A)
        • BraveUpdateComRegisterShell64.exe (PID: 2304 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe" MD5: F2CA542F38E6B51EDB9790369117F54A)
      • BraveUpdate.exe (PID: 7160 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTQ1IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE0NSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins5NTcyRUI5Qy1DQUU1LTQxOTgtQjNEOS0yODE3MDM5MzdEQzl9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7QkI0OTE1OUQtMjIxNi00MkQ4LUFFRTAtRTg3NDAxOEQ5RDA1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjIwMDYiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE0NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI1NDA2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
      • BraveUpdate.exe (PID: 6044 cmdline: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{9572EB9C-CAE5-4198-B3D9-281703937DC9} MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
  • BraveUpdate.exe (PID: 7092 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
  • BraveUpdate.exe (PID: 5924 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
    • BraveUpdate.exe (PID: 6724 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /uninstall MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
  • BraveUpdate.exe (PID: 7128 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
    • brave_installer-x64.exe (PID: 8960 cmdline: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Windows\TEMP\gui4A8.tmp MD5: 40976C35E6CA27871F134A8A2FCAFC21)
  • BraveUpdateOnDemand.exe (PID: 5964 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding MD5: 088EBFFD13539DBEF1204243C3558999)
    • BraveUpdate.exe (PID: 6320 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
      • iexplore.exe (PID: 1228 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
        • iexplore.exe (PID: 6288 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:9474 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
          • ie_to_edge_stub.exe (PID: 7212 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c MD5: 89CF8972D683795DAB6901BC9456675D)
          • ssvagent.exe (PID: 7256 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)
        • ie_to_edge_stub.exe (PID: 7220 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c MD5: 89CF8972D683795DAB6901BC9456675D)
          • msedge.exe (PID: 7288 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c MD5: 69222B8101B0601CC6663F8381E7E00F)
            • msedge.exe (PID: 7556 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2720 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
            • msedge.exe (PID: 3548 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6136 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
            • identity_helper.exe (PID: 8448 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5980 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
            • identity_helper.exe (PID: 8480 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5980 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
        • ssvagent.exe (PID: 7272 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)
        • iexplore.exe (PID: 2188 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:75012 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
          • ssvagent.exe (PID: 8200 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)
        • ssvagent.exe (PID: 8220 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)
        • iexplore.exe (PID: 8936 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:1316108 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
        • iexplore.exe (PID: 8968 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:9482 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
  • svchost.exe (PID: 3196 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • BraveUpdateOnDemand.exe (PID: 7220 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding MD5: 088EBFFD13539DBEF1204243C3558999)
    • BraveUpdate.exe (PID: 3428 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
      • iexplore.exe (PID: 5448 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
  • msedge.exe (PID: 9020 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7424 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2112,i,6464033333700142312,7804436323519571183,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • msedge.exe (PID: 7020 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 8144 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1680,i,16366133740763225394,16074541782411448469,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • BraveUpdateOnDemand.exe (PID: 8152 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding MD5: 088EBFFD13539DBEF1204243C3558999)
    • BraveUpdate.exe (PID: 7856 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
      • iexplore.exe (PID: 5740 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
  • BraveUpdateOnDemand.exe (PID: 3448 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding MD5: 088EBFFD13539DBEF1204243C3558999)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Use Short Name Path in Command Line
Source: Process startedAuthor: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine|base64offset|contains: w, Image: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, NewProcessName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, OriginalFileName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:9474 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 6288, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, ProcessId: 7256, ProcessName: ssvagent.exe
Sigma detected: Modification of IE Registry Settings
Source: Registry Key setAuthor: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 1228, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe
Sigma detected: Windows Processes Suspicious Parent Directory
Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3196, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

barindex
Uses 32bit PE files
Source: BraveBrowserSetup-BRV002.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
PE / OLE file has a valid certificate
Source: BraveBrowserSetup-BRV002.exeStatic PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: BraveBrowserSetup-BRV002.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: goopdateres_unsigned_ms.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FD9000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665024838.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1664696082.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665108566.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_ms.dll.1.dr
Source: Binary string: goopdateres_unsigned_fa.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002EC6000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002ED9000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1655250931.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1654572986.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1655082932.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_ru.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000003026000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003038000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667661885.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667587348.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667435836.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_lt.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663224996.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663432514.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663371906.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_el.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E74000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E87000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650762392.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650970092.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1651320024.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psmachine_unsigned_arm64.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1673085727.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, psmachine_arm64.dll.1.dr, psmachine_arm64.dll.0.dr
Source: Binary string: goopdateres_unsigned_tr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038BF000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030B3000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1669629225.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_de.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003686000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E79000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650594791.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650667068.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650456158.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_de.dll.0.dr
Source: Binary string: psuser_unsigned_arm64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000002.2425248649.0000000000AF4000.00000004.00000010.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1672203898.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_bg.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E35000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003642000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648911671.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648990259.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648729580.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_mr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000037D7000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1664450963.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1664247896.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1664545426.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_mr.dll.1.dr
Source: Binary string: BraveUpdateComRegisterShell64_unsigned.pdbS source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647471052.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000000.1683180912.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000000.1687330762.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000002.1689012406.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000008.00000000.1689802864.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000008.00000002.1691288695.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_gu.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1658905757.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659084309.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1658574693.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_gu.dll.1.dr, goopdateres_gu.dll.0.dr
Source: Binary string: goopdateres_unsigned_sr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000304E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003060000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1668435234.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_th.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038B2000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030A5000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1669428997.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveUpdateComRegisterShell64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647471052.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000000.1683180912.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000000.1687330762.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000002.1689012406.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000008.00000000.1689802864.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000008.00000002.1691288695.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psmachine_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1672552392.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psuser_unsigned_64.pdbG source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1671867210.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psuser_unsigned_arm64.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000002.2425248649.0000000000AF4000.00000004.00000010.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1672203898.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_am.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647982729.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648152192.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648235640.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: C:\jenkins\x64-release\src\out\Release\mini_installer.exe.pdb source: brave_installer-x64.exe, 0000002E.00000000.2118613662.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmp, brave_installer-x64.exe, 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmp, BIT544.tmp.17.dr
Source: Binary string: goopdateres_unsigned_cs.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649979934.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650050006.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649829274.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_lv.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000037BC000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FB0000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663765632.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663525408.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663680665.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_lv.dll.1.dr
Source: Binary string: goopdateres_unsigned_ta.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003089000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1669071444.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_ta.dll.1.dr
Source: Binary string: goopdate_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645793767.00000000043F1000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psuser_unsigned.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1671440640.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_hi.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003729000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F1C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659320072.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659384660.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659181549.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_hi.dll.0.dr, goopdateres_hi.dll.1.dr
Source: Binary string: goopdateres_unsigned_es-419.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036CA000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EBD000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652837281.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1653103343.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1653339516.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: mi_exe_stub.pdb source: BraveBrowserSetup-BRV002.exe
Source: Binary string: goopdateres_unsigned_pt-BR.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002FFD000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000300F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666361712.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666518792.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666607658.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.dr
Source: Binary string: BraveUpdate_unsigned.pdb source: BraveUpdate.exe, BraveUpdate.exe, 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 00000003.00000002.1692167614.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 00000006.00000002.1691548909.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 00000007.00000000.1689360352.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 00000009.00000002.1698574988.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 0000000A.00000000.1694403986.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 0000000B.00000000.1696891426.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 0000000C.00000000.1699014675.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 0000000E.00000002.1708989485.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 0000001A.00000000.1761926509.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 0000002B.00000002.2059249803.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, GUT4669.tmp.0.dr, BraveUpdate.exe.1.dr
Source: Binary string: goopdateres_unsigned_hr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F2A000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659650073.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659494915.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659716512.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_hr.dll.1.dr, goopdateres_hr.dll.0.dr
Source: Binary string: goopdateres_unsigned_id.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F45000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003752000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660307251.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660105918.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660240144.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_id.dll.0.dr
Source: Binary string: psuser_unsigned_64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1671867210.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_zh-TW.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003902000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000002.2425248649.0000000000AEE000.00000004.00000010.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1670815170.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveCrashHandlerArm64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647230921.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647181654.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveCrashHandler64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646526547.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveUpdateCore_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645947698.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646134207.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646182867.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, BraveUpdateCore.exe.1.dr
Source: Binary string: BraveCrashHandler_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646436390.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646477064.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646246445.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_sw.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003888000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000307C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1668871555.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveCrashHandler64_unsigned.pdb~ source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646526547.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_it.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F60000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000376D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1661510212.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660791109.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1661014960.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_pt-PT.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000300A000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000301D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666722472.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666855072.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666944474.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_pt-PT.dll.1.dr
Source: Binary string: goopdateres_unsigned_vi.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038E8000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030DB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1670380085.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_bn.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E42000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000364F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649100466.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649357847.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649278373.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_bn.dll.0.dr
Source: Binary string: BraveUpdateBroker_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1676019920.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1675639471.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1676251852.000000000102D000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr
Source: Binary string: goopdateres_unsigned_ja.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F69000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F7C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662200664.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662281197.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1661934489.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_ja.dll.0.dr
Source: Binary string: goopdateres_unsigned_sv.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000387B000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000306E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1668696033.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_sv.dll.1.dr
Source: Binary string: goopdateres_unsigned_es.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EB0000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036BD000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652663029.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652741088.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652326172.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_es.dll.0.dr
Source: Binary string: psmachine_unsigned_64.pdbG source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1672813816.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveUpdateCore_unsigned.pdbW source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645947698.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646134207.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646182867.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, BraveUpdateCore.exe.1.dr
Source: Binary string: goopdateres_unsigned_is.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003760000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660570940.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660629376.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660429527.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_fr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F01000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000370E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1658198876.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1657850418.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1658308545.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_uk.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.00000000030AE000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1669840480.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_ro.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003837000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000302A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667117339.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667269812.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667339932.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_ca.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E3E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E50000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649500615.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649748795.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649683028.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psmachine_unsigned_arm64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1673085727.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, psmachine_arm64.dll.1.dr, psmachine_arm64.dll.0.dr
Source: Binary string: goopdateres_unsigned_nl.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002FD4000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665230201.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665492995.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665407178.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_ko.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F83000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662994342.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662822293.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663089936.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_ko.dll.1.dr
Source: Binary string: goopdateres_unsigned_et.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1654347196.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1654252412.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1653571590.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveUpdateComRegisterShellArm64_unsigned.pdbW source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647700395.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647929197.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647877869.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_no.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003801000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665800212.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665608088.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665879303.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_te.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000003085000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003097000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1669260943.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_iw.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000377B000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1661728255.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1661601404.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1661796688.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_iw.dll.0.dr
Source: Binary string: goopdateres_unsigned_ur.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030CE000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038DA000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1670164253.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_ur.dll.0.dr
Source: Binary string: goopdateres_unsigned_fil.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EF3000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1656978587.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1656618421.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1657306499.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdate_unsigned.pdbz source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645793767.00000000043F1000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_pl.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003002000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000380E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666003809.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666168843.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666254244.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_pl.dll.1.dr
Source: Binary string: goopdateres_unsigned_en-GB.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036AF000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EA2000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652148182.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652004801.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652225654.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_ml.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FBD000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663877909.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1664044982.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1664133200.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psuser_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1671440640.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_fi.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1656305564.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1655694662.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1656116668.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_sk.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000003033000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003046000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667775535.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667932618.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1668008216.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_hu.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F26000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660013732.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659955501.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659804771.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveUpdateOnDemand_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1676988072.000000000102D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1676712899.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1676428744.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateOnDemand.exe, 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 0000000D.00000000.1703756956.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 00000019.00000000.1761241224.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 00000019.00000002.1763432229.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 0000002A.00000002.2058115467.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 0000002A.00000000.2054584520.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 0000002F.00000000.2120037936.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 0000002F.00000002.2122646917.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psmachine_unsigned.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1672552392.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_en.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E95000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1651568122.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000002.2413157352.0000000000FB0000.00000002.00000001.00040000.0000001C.sdmp, BraveUpdate.exe, 00000001.00000003.1651857943.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1651789398.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000002.00000002.1680615804.0000000000EA0000.00000002.00000001.00040000.0000000A.sdmp, BraveUpdate.exe, 00000007.00000002.1694614219.0000000000B90000.00000002.00000001.00040000.0000000A.sdmp, BraveUpdate.exe, 0000000B.00000002.2381519448.00000000013D0000.00000002.00000001.00040000.0000000A.sdmp, BraveUpdate.exe, 0000000C.00000002.2428277164.0000000001840000.00000002.00000001.00040000.0000000A.sdmp, BraveUpdate.exe, 0000000E.00000002.1708712100.0000000000810000.00000002.00000001.00040000.0000000A.sdmp, BraveUpdate.exe, 0000001A.00000002.1810659158.00000000011A0000.00000002.00000001.00040000.0000000A.sdmp, BraveUpdate.exe, 0000002B.00000002.2059688594.0000000001310000.00000002.00000001.00040000.0000000A.sdmp, GUT4669.tmp.0.dr, goopdateres_en.dll.0.dr
Source: Binary string: goopdateres_unsigned_da.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E6C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650140167.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650286286.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650358401.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_da.dll.0.dr
Source: Binary string: BraveUpdateComRegisterShellArm64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647700395.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647929197.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647877869.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psmachine_unsigned_64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1672813816.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_ar.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E16000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E28000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648537831.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648617305.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648356005.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_ar.dll.0.dr
Source: Binary string: goopdateres_unsigned_sl.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003860000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003053000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1668110214.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_zh-CN.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038F5000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030E8000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1670572756.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_kn.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F89000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F76000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662374811.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662586702.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662696270.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServerJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ElevationJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCode function: 1_2_003DD9B3 FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_003DD9B3
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009DD9B3 FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_009DD9B3
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682D1D68 FindFirstFileExW,4_2_00007FF7682D1D68
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 13_2_00C56405 FindFirstFileExW,13_2_00C56405
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
Source: Joe Sandbox ViewIP Address: 204.79.197.200 204.79.197.200
Source: Joe Sandbox ViewIP Address: 13.107.21.200 13.107.21.200
Source: Joe Sandbox ViewIP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox ViewIP Address: 23.51.57.215 23.51.57.215
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C
Source: iexplore.exe, 0000000F.00000002.2883831152.000002E960779000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2883831152.000002E960770000.00000004.00000020.00020000.00000000.sdmp, msapplication.xml8.15.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x482442c0,0x01da75e7</date><accdate>0x48261718,0x01da75e7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: URLhttp://www.facebook.com/ equals www.facebook.com (Facebook)
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: URLhttp://www.twitter.com/ equals www.twitter.com (Twitter)
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: URLhttp://www.youtube.com/ equals www.youtube.com (Youtube)
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.facebook.com/favicon.ico equals www.facebook.com (Facebook)
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.myspace.com/favicon.ico equals www.myspace.com (Myspace)
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/favicon.ico equals www.rambler.ru (Rambler)
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/v equals www.rambler.ru (Rambler)
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: iexplore.exe, 0000000F.00000002.2884076789.000002E960AD0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/p equals www.youtube.com (Youtube)
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amazon.fr/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ariadna.elmundo.es/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arianna.libero.it/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arianna.libero.it/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://asp.usatoday.com/
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://asp.usatoday.com/favicon.icoU
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://auone.jp/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://br.search.yahoo.com/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://browse.guardian.co.uk/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.buscape.com.br/r
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802116979.000002E95CC26000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.igbusca.com.br/1
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.orange.es/O
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.uol.com.br/m
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.lycos.es/W
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.com.br/I
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.com/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.es/%
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscar.ozu.es/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscar.ya.com/C
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busqueda.aol.com.mx/.
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cerca.lycos.it/1
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802116979.000002E95CC26000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cnet.search.com/b
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802495083.000002E95CC45000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://corp.naukri.com/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://corp.naukri.com/favicon.ico
Source: svchost.exe, 00000011.00000002.2877108350.00000159348B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: goopdateres_id.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://de.search.yahoo.com/5
Source: svchost.exe, 00000011.00000003.1714001746.0000015934A18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000011.00000003.1714001746.0000015934A18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000011.00000003.1714001746.0000015934A18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000011.00000003.1714001746.0000015934A18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000011.00000003.1714001746.0000015934A18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000011.00000003.1714001746.0000015934A18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000011.00000003.1714001746.0000015934A4D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://es.ask.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://es.search.yahoo.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://esearch.rakuten.co.jp/
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://espanol.search.yahoo.com/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://espn.go.com/favicon.ico
Source: svchost.exe, 00000011.00000003.1714001746.0000015934B07000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://find.joins.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fr.search.yahoo.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.pchome.com.tw/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.altervista.org/J
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.altervista.org/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ie8.ebay.com/open
Source: iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://images.monster.com/favicon.icor
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.atlas.cz/favicon.icoy
Source: iexplore.exe, 0000000F.00000003.1802116979.000002E95CC26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico.
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://in.search.yahoo.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://in.search.yahoo.com/-
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://it.search.dada.net/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://it.search.dada.net/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://it.search.yahoo.com/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jobsearch.monster.com/.
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://kr.search.yahoo.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://list.taobao.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&q=
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://msk.afisha.ru/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://ocsp.digicert.com0
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://ocsp.digicert.com0A
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://ocsp.digicert.com0C
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://ocsp.digicert.com0X
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p.zhongsou.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p.zhongsou.com/z
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://price.ru/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://price.ru/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://recherche.linternaute.com/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://recherche.tf1.fr/
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://rover.ebay.com~
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ru.search.yahoo.comg
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sads.myspace.com/g
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search-dyn.tiscali.it/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.about.com/L
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.alice.it/
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.alice.it/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.aol.co.uk/F
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.aol.com/p
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.aol.in/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.atlas.cz/X
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.auction.co.kr/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.auone.jp/3
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.books.com.tw/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.books.com.tw/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.centrum.cz/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.centrum.cz/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.chol.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.chol.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.cn.yahoo.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.daum.net/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.daum.net/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.daum.net/favicon.icoQ
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.dreamwiz.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.dreamwiz.com/P
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.dreamwiz.com/favicon.ico$
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.co.uk/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.com/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.com/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.com/favicon.icoo
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.de/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.es/h
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.fr/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.in/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.it/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.empas.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.empas.com/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.espn.go.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.gamer.com.tw/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.gamer.com.tw/favicon.icoL
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.gismeteo.ru/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.goo.ne.jp/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.goo.ne.jp/favicon.icou
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.hanafos.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.hanafos.com/D
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.hanafos.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.interpark.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ipop.co.kr/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876166636.000002E95CC10000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876393859.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&q=
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876393859.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&q=
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&amp;q=
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876393859.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&q=
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=AS5Z
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=AS6
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW
Source: iexplore.exe, 0000000F.00000002.2874009639.000002E95A091000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=IE7BOX&src=%7Breferrer:source?%7Dz
Source: iexplore.exe, 0000000F.00000002.2874009639.000002E95A091000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=IE7RE&src=%7Breferrer:source?%7D
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95D009000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=MSNIE7&src=%7Breferrer:source?%7D.
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95D009000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&Form=IE8SRC&src=%7Breferrer:source%7D
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CF4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&mkt=%7BLanguage%7D&FORM=IE8SRC&src=%7Breferr
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CF4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&src=%7Breferrer:source?%7D
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95D009000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&src=%7Breferrer:source?%7D&Form=IE8SRC
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CF4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&src=IE-SearchBox&Form=IE8SRC
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.livedoor.com/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.livedoor.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.lycos.co.uk/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.lycos.com/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.lycos.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS5f
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS6
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=%7BsearchTerms%7D&FORM=AS5
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=%7BsearchTerms%7D&FORM=AS6
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=%7BsearchTerms%7D&FORM=CBPWT
Source: iexplore.exe, 0000000F.00000002.2876393859.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=%7BsearchTerms%7D&FORM=AS5
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=%7BsearchTerms%7D&FORM=AS6
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW:
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.nate.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.naver.com/8
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.naver.com/favicon.icoG
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.nifty.com/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.orange.co.uk/?
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.rediff.com/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.rediff.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.seznam.cz/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.seznam.cz/s
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.sify.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.co.jp
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.co.jp4
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&amp;p=
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&p=
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yam.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yam.com/&
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search1.taobao.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search1.taobao.com/n
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search2.estadao.com.br/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://searchresults.news.com.au/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://service2.bfast.com/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://so-net.search.goo.ne.jp/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.aol.de/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.freenet.de/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.freenet.de/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.lycos.de/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.t-online.de/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.web.de/
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.web.de/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tw.search.yahoo.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://udn.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://udn.com/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://uk.ask.com/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://uk.ask.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://uk.search.yahoo.com/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vachercher.lycos.fr/)
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://video.globo.com/d
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://video.globo.com/favicon.ico8
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.ask.com/
Source: iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876393859.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.abril.com.br/
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876393859.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.abril.com.br/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.abril.com.br/favicon.ico=
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.alarabiya.net/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.co.jp/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.co.uk/
Source: iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmp, msapplication.xml.15.drString found in binary or memory: http://www.amazon.com/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&keyword=
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/favicon.icoL
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&tag=ie8search-20&index=blended&linkCode=qs&camp=1789&creativ
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.de/T
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.aol.com/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.arrakis.com/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.arrakis.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.asharqalawsat.com/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ask.com/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.auction.co.kr/auction.ico2
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cdiscount.com/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876393859.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ceneo.pl/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ceneo.pl/_
Source: iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876393859.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico##
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cjmall.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cjmall.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cjmall.com/favicon.icoX
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.clarin.com/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cnet.co.uk/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cnet.com/favicon.icoK
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.dailymail.co.uk/R
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.drString found in binary or memory: http://www.digicert.com/CPS0
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.etmall.com.tw/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.excite.co.jp/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.expedia.com/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.expedia.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gismeteo.ru/favicon.ico$
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gmarket.co.kr/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gmarket.co.kr/favicon.icoR
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.co.in/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.co.jp/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.co.uk/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.br/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.sa/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.tw/
Source: iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/:
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/B
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/favicon.icoB
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.cz/6
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.de/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.es/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.fr/#
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.it/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.pl/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.ru/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.si/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iask.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iask.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.kkbox.com.tw/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.kkbox.com.tw/favicon.ico6
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.linternaute.com/favicon.icoj
Source: iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.live.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.maktoob.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mercadolibre.com.mx/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mercadolibre.com.mx/favicon.icoz
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mercadolivre.com.br/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876393859.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.merlin.com.pl/
Source: iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1712243680.000002E95A0F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.msftconnecttest.com/
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mtv.com/B
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mtv.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.myspace.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.najdi.si/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.najdi.si/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nate.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.neckermann.de/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.neckermann.de/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.news.com.au/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nifty.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nytimes.com/
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ocn.ne.jp/favicon.icoN
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.orange.fr/u
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.otto.de/favicon.icof
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ozon.ru/=
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ozon.ru/favicon.ico#
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ozu.es/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.paginasamarillas.es/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.paginasamarillas.es/favicon.icoJ
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.priceminister.com/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.priceminister.com/favicon.ico:
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rakuten.co.jp/favicon.icoZ
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/v
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.recherche.aol.fr/
Source: iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.reddit.com/
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rtl.de/
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rtl.de/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.servicios.clarin.com/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.shopzilla.com/
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sify.com/favicon.ico8
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.so-net.ne.jp/share/favicon.icoB
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sogou.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sogou.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.soso.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.soso.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.t-online.de/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.taobao.com/
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.taobao.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.target.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.target.com/y
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tchibo.de/A
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tchibo.de/favicon.icop
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tesco.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tesco.com/k
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tiscali.it/favicon.icoB
Source: iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.twitter.com/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.univision.com/
Source: iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.univision.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.walmart.com/
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.walmart.com/favicon.ico.
Source: iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.wikipedia.com/
Source: iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ya.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yam.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2883831152.000002E960779000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2883831152.000002E960770000.00000004.00000020.00020000.00000000.sdmp, msapplication.xml8.15.drString found in binary or memory: http://www.youtube.com/
Source: iexplore.exe, 0000000F.00000002.2884076789.000002E960AD0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/p
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www3.fnac.com/
Source: iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www3.fnac.com/favicon.ico
Source: iexplore.exe, 0000000F.00000003.1802116979.000002E95CC26000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation=ItemSea
Source: iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://z.about.com/m/a08.ico
Source: me[1].json.28.drString found in binary or memory: https://abcnews.go.com/US/nex-benedict-died-suicide-medical-examiners-report-states/story?id=1080934
Source: me[1].json.28.drString found in binary or memory: https://abcnews.go.com/US/trump-expected-attend-hearing-seek-dismissal-classified-documents/story?id
Source: iexplore.exe, 0000000F.00000003.1921001030.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1916013453.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: iexplore.exe, 0000000F.00000003.1921001030.000002E95CEA0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CEA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
Source: iexplore.exe, 0000000F.00000003.1921001030.000002E95CEA0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CEA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOSMP
Source: me[1].json.28.drString found in binary or memory: https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=63ef3fec-aefa-487d-9714-65fe51d48535&
Source: me[1].json.28.drString found in binary or memory: https://apnews.com/article/artificial-intelligence-elections-disinformation-chatgpt-bc283e7426402f0b
Source: 5EQPBFWM.htm.45.dr, TTY4BA68.htm.16.drString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.3864859aea200a56092d.js
Source: 5EQPBFWM.htm.45.dr, TTY4BA68.htm.16.drString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.1287eb605f92d676502d.js
Source: 5EQPBFWM.htm.45.dr, TTY4BA68.htm.16.drString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.afc9b4502f5cf6f88cca.js
Source: 5EQPBFWM.htm.45.dr, TTY4BA68.htm.16.drString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.79af82f3c5b028c7ea81.js
Source: me[1].json.28.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGB8
Source: me[1].json.28.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGB8-dark
Source: me[1].json.28.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or
Source: me[1].json.28.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or-dark
Source: me[1].json.28.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: me[1].json.28.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: me[1].json.28.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRnR
Source: me[1].json.28.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRnR-dark
Source: me[1].json.28.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13govM
Source: me[1].json.28.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13govM-dark
Source: manifest.json.22.drString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: iexplore.exe, 0000000F.00000003.1919880394.000002E96028A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1916013453.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1923622981.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json.22.drString found in binary or memory: https://docs.google.com/
Source: manifest.json.22.drString found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.22.drString found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.22.drString found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.22.drString found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.22.drString found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.22.drString found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.22.drString found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.22.drString found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.22.drString found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.22.drString found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.22.drString found in binary or memory: https://drive.google.com/
Source: 000003.log5.22.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: svchost.exe, 00000011.00000003.1714001746.0000015934AC2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000011.00000003.1714001746.0000015934AFF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000011.00000003.1714001746.0000015934AC2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000011.00000003.1714001746.0000015934AA3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1714001746.0000015934AC2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1714001746.0000015934AE8000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1714001746.0000015934B07000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000011.00000003.1714001746.0000015934AC2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: me[1].json.28.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA12I8qo.img
Source: me[1].json.28.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: me[1].json.28.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA5DAVD.img
Source: me[1].json.28.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AACl6Lf.img
Source: me[1].json.28.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAywOab.img
Source: me[1].json.28.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBACBCB.img
Source: iexplore.exe, 0000000F.00000003.1712243680.000002E95A125000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1892783640.000002E95CE0C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2874009639.000002E95A125000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CE0C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1921001030.000002E95CE0C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2874009639.000002E95A0F6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1712243680.000002E95A0F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=000000
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CE35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: iexplore.exe, 0000000F.00000003.1921001030.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1916013453.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld219
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: iexplore.exe, 0000000F.00000003.1921001030.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1916013453.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2879568803.000002E9601A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: iexplore.exe, 0000000F.00000003.1712243680.000002E95A125000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.coma
Source: iexplore.exe, 0000000F.00000003.1892783640.000002E95CE00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.comd
Source: svchost.exe, 00000011.00000003.1714001746.0000015934AC2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000011.00000003.1714001746.0000015934A56000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645793767.00000000043F1000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.drString found in binary or memory: https://support.brave.com/hlproductfrom_extra_codesptestsource%1%2ATL:%p%s
Source: me[1].json.28.drString found in binary or memory: https://thehill.com/opinion/campaign/4528680-trumps-gop-is-already-dying/
Source: me[1].json.28.drString found in binary or memory: https://thehill.com/opinion/judiciary/4524245-the-supreme-court-granted-trump-amnesty-it-has-no-powe
Source: BraveUpdate.exe, 0000000C.00000003.2383920123.0000000002620000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2404999756.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2398517429.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.1811089832.0000000002E37000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.1810814031.0000000002E37000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2404999756.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.1810204036.0000000002E32000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2381795275.0000000002938000.00000004.00000800.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2407356540.0000000000FFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates-cdn.bravesoftware.com/build/Brave-Release/release/win/122.1.63.174/x64/
Source: svchost.exe, 00000011.00000002.2874337170.000001592F22B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2878356377.0000015934AF0000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2875801724.0000015930040000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://updates-cdn.bravesoftware.com/build/Brave-Release/release/win/122.1.63.174/x64/brave_install
Source: BraveUpdate.exe, 0000000C.00000003.2404999756.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000002.2427386217.0000000000FDB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates-cdn.bravesoftware.com/build/Brave-Release/release/win/122.1.63.174/x64/pX
Source: BraveUpdate.exe, 0000000A.00000003.1704442118.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000003.1704698234.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000002.1707267452.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2409314044.0000000000F47000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2404600749.0000000000F40000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000002.2426869012.0000000000F48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645793767.00000000043F1000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.drString found in binary or memory: https://updates.bravesoftware.com/cr/reportBraveSoftware
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645793767.00000000043F1000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.drString found in binary or memory: https://updates.bravesoftware.com/service/check2/recover&appid=%s&appversion=%s&applang=%s&machine=%
Source: BraveUpdate.exe, 0000000A.00000003.1704442118.0000000000DB2000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000002.2426674497.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2404600749.0000000000F40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/service/update2
Source: BraveUpdate.exe, 0000000A.00000002.1707124813.0000000000D7C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/service/update2%h
Source: BraveUpdate.exe, 0000000A.00000002.1707124813.0000000000D7C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/service/update2(
Source: BraveUpdate.exe, 0000000C.00000002.2427386217.0000000000F88000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2409314044.0000000000F47000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2404600749.0000000000F40000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2404999756.0000000000F88000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000002.2426869012.0000000000F48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/service/update2?cup2key=2:cZeoWWTFzuccOJ1vtZZt3pAiJUqbs4Ho2gNjDH6z
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645793767.00000000043F1000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.drString found in binary or memory: https://updates.bravesoftware.com/support/installer/?https://updates.bravesoftware.com/service/updat
Source: BraveUpdate.exe, 0000000A.00000002.1707124813.0000000000D59000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com:443/service/update2
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CD67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/
Source: me[1].json.28.drString found in binary or memory: https://www.forbes.com/sites/alisondurkee/2024/03/13/justice-brett-kavanaugh-is-not-an-honest-person
Source: content_new.js.22.drString found in binary or memory: https://www.google.com/chrome
Source: me[1].json.28.drString found in binary or memory: https://www.hollywoodreporter.com/tv/tv-news/robyn-bernard-dead-general-hospital-actress-1235852051/
Source: me[1].json.28.drString found in binary or memory: https://www.independent.co.uk/arts-entertainment/tv/news/kristen-stewart-stephen-colbert-cbs-b251240
Source: me[1].json.28.drString found in binary or memory: https://www.independent.co.uk/news/world/americas/man-iron-lung-dead-paul-alexander-b2511827.html
Source: me[1].json.28.drString found in binary or memory: https://www.indy100.com/science-tech/mystery-structures-milky-way
Source: me[1].json.28.drString found in binary or memory: https://www.mmamania.com/2024/3/13/24099921/mark-coleman-update-intubated-ufc-vet-somewhat-conscious
Source: me[1].json.28.drString found in binary or memory: https://www.mmamania.com/2024/3/13/24100135/gel-gate-chito-vera-says-sean-omalley-was-greased-to-the
Source: iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CD67000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CEA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/.
Source: iexplore.exe, 0000000F.00000003.1921001030.000002E95CEA0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CEA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/9f
Source: {79BADE10-E1DA-11EE-8C2C-ECF4BBEA1588}.dat.15.dr, ~DF9AF92C7928DA52EC.TMP.15.drString found in binary or memory: https://www.msn.com/?ocid=iehp
Source: iexplore.exe, 0000000F.00000002.2880171716.000002E96029E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp$gS
Source: iexplore.exe, 0000000F.00000002.2884160169.000002E962F3F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp%
Source: iexplore.exe, 0000000F.00000002.2880171716.000002E96029E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp-cL
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9603E1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2880896248.000002E9604DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp.ico
Source: iexplore.exe, 0000000F.00000002.2884160169.000002E962F52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CD67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/Yw
Source: iexplore.exe, 0000000F.00000003.1921001030.000002E95CE35000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CE35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/fwlink/p/?LinkId=255141
Source: iexplore.exe, 0000000F.00000003.1892783640.000002E95CE00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/fwlink/p/?LinkId=255141er
Source: iexplore.exe, 0000000F.00000002.2874009639.000002E95A060000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2878382831.000002E95CF4F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/p/?LinkId=255141
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/p/?LinkId=2551418
Source: iexplore.exe, 0000000F.00000002.2874009639.000002E95A091000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/p/?LinkId=255141x
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9604DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp4
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9603E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp8
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp8.100.80
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CDC0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1921001030.000002E95CDC0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1892783640.000002E95CDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp;#8
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9604AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp?iw
Source: iexplore.exe, 0000000F.00000002.2880171716.000002E9602B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpD
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CF04000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2880896248.000002E9604AC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1916013453.000002E95CF04000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1923622981.000002E95CF04000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1921001030.000002E95CF04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpF
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpG
Source: iexplore.exe, 0000000F.00000002.2880171716.000002E96029E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpGg6
Source: iexplore.exe, 0000000F.00000002.2884160169.000002E962F58000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2880896248.000002E96057D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpMSN
Source: iexplore.exe, 0000000F.00000003.1916013453.000002E95CF26000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1923622981.000002E95CF26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpMSN-
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E960553000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpMSNB6
Source: iexplore.exe, 0000000F.00000003.1892783640.000002E95CE00000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CE00000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2879568803.000002E9601A0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1921001030.000002E95CE00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpMicrosoft
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpNm
Source: iexplore.exe, 0000000F.00000003.1916013453.000002E95CEFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpP
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CD67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpQY
Source: iexplore.exe, 0000000F.00000003.1921001030.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2878382831.000002E95D009000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1916013453.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2884160169.000002E962F66000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1923622981.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpTerms
Source: iexplore.exe, 0000000F.00000002.2880171716.000002E9602B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpV
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9604AC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2880171716.000002E9602B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpX
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpXkV8h
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9603E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpZ/
Source: iexplore.exe, 0000000F.00000002.2880171716.000002E96029E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpZg1
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9604AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpah-
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9604DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpb
Source: iexplore.exe, 0000000F.00000003.1892783640.000002E95CE00000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2879568803.000002E9601A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpcid=iehpt
Source: iexplore.exe, 0000000F.00000002.2880171716.000002E96029E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpco
Source: iexplore.exe, 0000000F.00000003.1921001030.000002E95CEB3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1923622981.000002E95CEB3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1916013453.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpcrosoft
Source: iexplore.exe, 0000000F.00000002.2884160169.000002E962F3F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpd
Source: iexplore.exe, 0000000F.00000003.1921001030.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1916013453.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1923622981.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpearchTerms
Source: iexplore.exe, 0000000F.00000003.1921001030.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpehpehps
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CE00000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1921001030.000002E95CE00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpehpkID=403856&language=
Source: iexplore.exe, 0000000F.00000002.2880171716.000002E9602B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpf
Source: iexplore.exe, 0000000F.00000002.2880171716.000002E9602B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpg
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehph
Source: iexplore.exe, 0000000F.00000002.2880171716.000002E9602B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehph20
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CE00000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1921001030.000002E95CE00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehphTerms
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CD67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpiX
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9604AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpico
Source: iexplore.exe, 0000000F.00000003.1916013453.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpiehpehps
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CE00000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1921001030.000002E95CE00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpiehphTerms
Source: iexplore.exe, 0000000F.00000003.1921001030.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1916013453.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpiehpn.com/?ocid=iehprchBox&FORM=IE11SR
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpion
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CD67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpl
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9603E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpll
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95D009000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2879568803.000002E9601A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehposoft
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9604AC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2879568803.000002E9601F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2880171716.000002E9602B4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2884160169.000002E962F52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141k7
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141se
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CD67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehppX
Source: iexplore.exe, 0000000F.00000003.1892783640.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehprchBox&FORM=IE11SR
Source: iexplore.exe, 0000000F.00000002.2879568803.000002E9601A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehprosoft
Source: iexplore.exe, 0000000F.00000002.2874959269.000002E95B9D0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpstorageTeststorageTest)Q
Source: iexplore.exe, 0000000F.00000002.2874959269.000002E95B9D0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpstorageTeststorageTest817969D6
Source: iexplore.exe, 0000000F.00000002.2874959269.000002E95B9D0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpstorageTeststorageTestn.com/?ocid=iehpm
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9604DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpv
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9603E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpv$
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CD67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpwY_
Source: iexplore.exe, 0000000F.00000002.2874009639.000002E95A091000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpws
Source: iexplore.exe, 0000000F.00000003.1902952917.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpww.msn.com/?ocid=iehpC
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9603E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpy#
Source: iexplore.exe, 0000000F.00000002.2880171716.000002E960279000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp~
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E96041B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2879568803.000002E9601A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.ico
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E960566000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2884160169.000002E962F3F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.ico/
Source: iexplore.exe, 0000000F.00000003.1915878658.000002E96029D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.ico0dg
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E96052F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.ico:Sat:Saturday
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9603E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.ico:Sat:Saturday7
Source: iexplore.exe, 0000000F.00000003.1915878658.000002E96029D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.ico:dQ
Source: iexplore.exe, 0000000F.00000003.1915878658.000002E96029D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.ico=d
Source: iexplore.exe, 0000000F.00000003.1915878658.000002E96029D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icoHc/
Source: iexplore.exe, 0000000F.00000003.1915878658.000002E96029D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icoPo8
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CE14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icoS
Source: iexplore.exe, 0000000F.00000002.2876669990.000002E95CE14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icoX
Source: iexplore.exe, 0000000F.00000002.2880171716.000002E96029E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icoYc0
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E960566000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icoZ
Source: iexplore.exe, 0000000F.00000002.2872751827.000000F7076F6000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icok
Source: iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icorosoft
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E96052F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icot
Source: iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icotls-server-end-point:
Source: experience.1287eb605f92d676502d[1].js.16.drString found in binary or memory: https://www.msn.com/fr-ch/actualite/other/Mentions-l
Source: iexplore.exe, 0000000F.00000002.2880896248.000002E9603DD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CDFC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1921001030.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1921001030.000002E95CDFC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2878382831.000002E95CFBD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2884160169.000002E962F3B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2880171716.000002E96030C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1916013453.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1892783640.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2880896248.000002E96052B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2880896248.000002E960494000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/spartan/ientp?locale=en-CH&market=CH&enableregulatorypsm=0&enablecpsm=0&NTLogo=0
Source: me[1].json.28.drString found in binary or memory: https://www.telegraph.co.uk/news/2024/03/13/canada-is-descending-into-tyranny-under-trudeau/
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682C498C lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,4_2_00007FF7682C498C
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682C498C lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,4_2_00007FF7682C498C

System Summary

barindex
Downloads suspicious files via Chrome
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile dump: C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\eventpage_bin_prod.jsJump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile dump: C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\page_embed_script.jsJump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile dump: C:\Users\user\AppData\Local\Temp\scoped_dir7288_262633448\CRX_INSTALL\content.jsJump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile dump: C:\Users\user\AppData\Local\Temp\scoped_dir7288_262633448\CRX_INSTALL\content_new.jsJump to dropped file
Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008E41980_2_008E4198
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008D5AB60_2_008D5AB6
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008E7A0B0_2_008E7A0B
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008DC5D40_2_008DC5D4
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008E3D100_2_008E3D10
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008E168D0_2_008E168D
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCode function: 1_2_003E3C0B1_2_003E3C0B
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009E3C0B2_2_009E3C0B
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682CD1644_2_00007FF7682CD164
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682D15484_2_00007FF7682D1548
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682D1D684_2_00007FF7682D1D68
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682CD81C4_2_00007FF7682CD81C
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 13_2_00C5C7FB13_2_00C5C7FB
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 26_2_0335CB4A26_2_0335CB4A
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 26_2_0335CBBE26_2_0335CBBE
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exeCode function: 46_2_00007FF6AA52133046_2_00007FF6AA521330
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: String function: 00C51AB0 appears 32 times
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: String function: 008D2BA0 appears 236 times
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: String function: 008D6F60 appears 32 times
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCode function: String function: 003D7FA0 appears 33 times
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: String function: 009D7FA0 appears 33 times
Source: goopdateres_ca.dll.0.drStatic PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-II ECOFF executable not stripped - version 0.114
Source: goopdateres_fil.dll.0.drStatic PE information: Resource name: RT_STRING type: VAX COFF executable, sections 80, created Wed Mar 25 10:31:05 1970, not stripped, version 108
Source: goopdateres_hu.dll.0.drStatic PE information: Resource name: RT_STRING type: MIPSEL MIPS-II ECOFF executable not stripped - version 0.101
Source: goopdateres_ms.dll.0.drStatic PE information: Resource name: RT_STRING type: 370 sysV executable not stripped
Source: goopdateres_th.dll.0.drStatic PE information: Resource name: RT_STRING type: PDP-11 overlaid pure executable not stripped
Source: goopdateres_tr.dll.0.drStatic PE information: Resource name: RT_STRING type: 370 XA sysV pure executable not stripped
Source: goopdateres_vi.dll.0.drStatic PE information: Resource name: RT_STRING type: iAPX 286 executable small model (COFF) not stripped
Source: goopdateres_hu.dll.1.drStatic PE information: Resource name: RT_STRING type: MIPSEL MIPS-II ECOFF executable not stripped - version 0.101
Source: goopdateres_ms.dll.1.drStatic PE information: Resource name: RT_STRING type: 370 sysV executable not stripped
Source: goopdateres_th.dll.1.drStatic PE information: Resource name: RT_STRING type: PDP-11 overlaid pure executable not stripped
Source: goopdateres_tr.dll.1.drStatic PE information: Resource name: RT_STRING type: 370 XA sysV pure executable not stripped
Source: goopdateres_vi.dll.1.drStatic PE information: Resource name: RT_STRING type: iAPX 286 executable small model (COFF) not stripped
Source: goopdateres_ca.dll.1.drStatic PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-II ECOFF executable not stripped - version 0.114
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FBD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_lv.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ca.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003860000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sk.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_is.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E4C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ca.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000304E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sl.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F26000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_hr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBraveUpdate.exeJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdate.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038B2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_te.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_es-419.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F01000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fil.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003801000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_nl.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000376D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_is.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002FFD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_pl.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000003085000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ta.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EE6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fa.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E42000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_bg.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E16000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_am.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.00000000030EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_zh-TW.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002FAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_lv.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000037E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_mr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBraveUpdate.exeJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdate.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003888000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sv.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ja.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F83000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_kn.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003002000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_no.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036AF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_en.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E35000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ar.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003686000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_da.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003097000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ta.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FD9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_mr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F69000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_iw.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000370E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fil.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000037D7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ml.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000003026000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ro.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000002.2425248649.0000000000AF4000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_zh-TW.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_am.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E3E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_bn.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F91000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ko.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000003033000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ru.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000377B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_it.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000037BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_lt.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FB0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_lt.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000387B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EB0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_en-GB.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E79000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_da.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F0F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000003077000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sw.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_de.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003902000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_zh-CN.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1637795034.0000000000CFE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBraveUpdateSetup.exeJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002FD4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ms.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003046000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ru.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_tr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002ECB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_es-419.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038F5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_vi.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002EFC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036BD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_en-GB.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ml.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003837000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_pt-PT.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F7C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_iw.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000300F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_pl.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000364F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_bg.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F45000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_hu.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FA3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ko.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E95000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_el.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EA2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_en.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.00000000030AE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_tr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038BF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_th.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003642000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ar.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002EC6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_et.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FF4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_nl.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_uk.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E50000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_bn.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000380E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_no.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003060000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sl.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E59000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_cs.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003102000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_zh-TW.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F53000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_id.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003089000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sw.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F76000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ja.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000306E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F2A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_hi.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003053000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sk.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_vi.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003760000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_id.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FE7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ms.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EF3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fi.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003729000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_gu.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ur.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000300A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_pt-BR.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E6C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_cs.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E87000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_de.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003752000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_hu.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fa.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000307C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sv.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F6E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_it.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030DB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ur.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036CA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_es.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F1C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_gu.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_el.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EBD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_es.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBraveUpdate.exeJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdate.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_et.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F38000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_hr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F95000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_kn.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002EE1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fi.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030B3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_th.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030F6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_zh-CN.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F18000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_hi.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000301D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_pt-BR.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038DA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_uk.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003038000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ro.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000302A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_pt-PT.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_te.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exeBinary or memory string: OriginalFilenameBraveUpdateSetup.exeJ vs BraveBrowserSetup-BRV002.exe
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: propsys.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: edputil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: slc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: sppc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: winhttp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: webio.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: winnsi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: rasadhlp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: schannel.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntasn1.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ncrypt.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msxml3.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: atlthunk.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: textinputframework.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: coremessaging.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: textshaping.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msxml3.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: winhttp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: webio.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: winnsi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: rasadhlp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: schannel.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntasn1.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ncrypt.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: winsta.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: bitsproxy.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dll
Source: BraveBrowserSetup-BRV002.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engineClassification label: mal51.evad.winEXE@107/553@0/35
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008D324D GetLastError,GetLastError,SetLastError,SetLastError,FormatMessageW,GetLastError,SetLastError,LocalFree,0_2_008D324D
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008D2024 GetTempFileNameW,FindResourceW,LoadResource,LockResource,CreateFileW,SizeofResource,SetFilePointerEx,CloseHandle,0_2_008D2024
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftwareJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeFile created: C:\Users\user\AppData\Local\BraveSoftware
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BraveSoftware{BC6A0F04-AE75-459F-B879-2C961515B78A}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BraveSoftwareS-1-5-21-2246122658-3693405117-2476756634-1002{BC6A0F04-AE75-459F-B879-2C961515B78A}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \BaseNamedObjects\Global\BraveSoftware{C50974A0-5616-4DC6-AC6D-D4EFF6F5FAC3}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \BaseNamedObjects\Global\BraveSoftware{FE0E7F6B-B8BD-4EEE-A8F1-8CE625AEF520}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \BaseNamedObjects\Global\BraveSoftware{BC6A0F04-AE75-459F-B879-2C961515B78A}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \BaseNamedObjects\Global\BraveSoftware{4E15433F-5E08-47A1-AA4F-B1D1657EE725}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \BaseNamedObjects\Global\BraveSoftware{BD1D9A71-3C5B-436B-BAD8-D337E3226819}
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BraveSoftware{C50974A0-5616-4DC6-AC6D-D4EFF6F5FAC3}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \BaseNamedObjects\Global\BraveSoftware{0EADE80E-E9B8-4A5D-AF64-6D2A918F597C}
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmpJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCommand line argument: kernel32.dll0_2_008D277B
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCommand line argument: kernel32.dll1_2_003D6C1E
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCommand line argument: DllEntry1_2_003D6C1E
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCommand line argument: kernel32.dll2_2_009D6C1E
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCommand line argument: DllEntry2_2_009D6C1E
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCommand line argument: BraveUpdate.exe13_2_00C51152
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: BraveBrowserSetup-BRV002.exeString found in binary or memory: %1!s!-Installer
Source: BraveBrowserSetup-BRV002.exeString found in binary or memory: r den %1!s!-Installer wird Windows 2000 Service Pack 4 oder h
Source: BraveBrowserSetup-BRV002.exeString found in binary or memory: Installer ng %1!s! Hindi Alam na Error ng InstallerlNabigo ang pag-install. Nangangailangan ang Installer ng %1!s! ng Windows 2000 Service Pack 4 o mas mahusay.
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile read: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exeEvasive API call chain: GetCommandLine,DecisionNodes,ExitProcess
Source: unknownProcess created: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeProcess created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe"
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe"
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe"
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /uninstall
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTQ1IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE0NSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins5NTcyRUI5Qy1DQUU1LTQxOTgtQjNEOS0yODE3MDM5MzdEQzl9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7QkI0OTE1OUQtMjIxNi00MkQ4LUFFRTAtRTg3NDAxOEQ5RDA1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjIwMDYiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE0NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI1NDA2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{9572EB9C-CAE5-4198-B3D9-281703937DC9}
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:9474 /prefetch:2
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2720 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:75012 /prefetch:2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6136 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:8
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5980 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5980 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:8
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:1316108 /prefetch:2
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2112,i,6464033333700142312,7804436323519571183,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1680,i,16366133740763225394,16074541782411448469,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:9482 /prefetch:2
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exe C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Windows\TEMP\gui4A8.tmp
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeProcess created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=noneJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvcJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserverJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTQ1IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE0NSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins5NTcyRUI5Qy1DQUU1LTQxOTgtQjNEOS0yODE3MDM5MzdEQzl9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7QkI0OTE1OUQtMjIxNi00MkQ4LUFFRTAtRTg3NDAxOEQ5RDA1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjIwMDYiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE0NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI1NDA2Ii8-PC9hcHA-PC9yZXF1ZXN0PgJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{9572EB9C-CAE5-4198-B3D9-281703937DC9}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe" Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe" Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe" Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /uninstallJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exe C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Windows\TEMP\gui4A8.tmp
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:9474 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:75012 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:1316108 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:9482 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: unknown unknown
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2720 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6136 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5980 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5980 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2112,i,6464033333700142312,7804436323519571183,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1680,i,16366133740763225394,16074541782411448469,262144 /prefetch:3
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\Office\16.0\Lync
Source: BraveBrowserSetup-BRV002.exeStatic PE information: certificate valid
Source: BraveBrowserSetup-BRV002.exeStatic file information: File size 1446992 > 1048576
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x136800
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: BraveBrowserSetup-BRV002.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: goopdateres_unsigned_ms.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FD9000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665024838.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1664696082.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665108566.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_ms.dll.1.dr
Source: Binary string: goopdateres_unsigned_fa.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002EC6000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002ED9000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1655250931.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1654572986.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1655082932.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_ru.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000003026000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003038000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667661885.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667587348.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667435836.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_lt.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663224996.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663432514.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663371906.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_el.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E74000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E87000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650762392.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650970092.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1651320024.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psmachine_unsigned_arm64.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1673085727.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, psmachine_arm64.dll.1.dr, psmachine_arm64.dll.0.dr
Source: Binary string: goopdateres_unsigned_tr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038BF000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030B3000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1669629225.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_de.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003686000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E79000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650594791.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650667068.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650456158.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_de.dll.0.dr
Source: Binary string: psuser_unsigned_arm64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000002.2425248649.0000000000AF4000.00000004.00000010.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1672203898.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_bg.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E35000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003642000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648911671.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648990259.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648729580.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_mr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000037D7000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1664450963.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1664247896.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1664545426.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_mr.dll.1.dr
Source: Binary string: BraveUpdateComRegisterShell64_unsigned.pdbS source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647471052.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000000.1683180912.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000000.1687330762.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000002.1689012406.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000008.00000000.1689802864.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000008.00000002.1691288695.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_gu.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1658905757.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659084309.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1658574693.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_gu.dll.1.dr, goopdateres_gu.dll.0.dr
Source: Binary string: goopdateres_unsigned_sr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000304E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003060000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1668435234.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_th.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038B2000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030A5000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1669428997.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveUpdateComRegisterShell64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647471052.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000000.1683180912.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000000.1687330762.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000002.1689012406.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000008.00000000.1689802864.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, BraveUpdateComRegisterShell64.exe, 00000008.00000002.1691288695.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psmachine_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1672552392.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psuser_unsigned_64.pdbG source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1671867210.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psuser_unsigned_arm64.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000002.2425248649.0000000000AF4000.00000004.00000010.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1672203898.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_am.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647982729.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648152192.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648235640.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: C:\jenkins\x64-release\src\out\Release\mini_installer.exe.pdb source: brave_installer-x64.exe, 0000002E.00000000.2118613662.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmp, brave_installer-x64.exe, 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmp, BIT544.tmp.17.dr
Source: Binary string: goopdateres_unsigned_cs.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649979934.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650050006.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649829274.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_lv.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000037BC000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FB0000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663765632.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663525408.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663680665.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_lv.dll.1.dr
Source: Binary string: goopdateres_unsigned_ta.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003089000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1669071444.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_ta.dll.1.dr
Source: Binary string: goopdate_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645793767.00000000043F1000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psuser_unsigned.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1671440640.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_hi.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003729000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F1C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659320072.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659384660.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659181549.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_hi.dll.0.dr, goopdateres_hi.dll.1.dr
Source: Binary string: goopdateres_unsigned_es-419.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036CA000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EBD000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652837281.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1653103343.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1653339516.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: mi_exe_stub.pdb source: BraveBrowserSetup-BRV002.exe
Source: Binary string: goopdateres_unsigned_pt-BR.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002FFD000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000300F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666361712.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666518792.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666607658.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.dr
Source: Binary string: BraveUpdate_unsigned.pdb source: BraveUpdate.exe, BraveUpdate.exe, 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 00000003.00000002.1692167614.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 00000006.00000002.1691548909.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 00000007.00000000.1689360352.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 00000009.00000002.1698574988.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 0000000A.00000000.1694403986.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 0000000B.00000000.1696891426.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 0000000C.00000000.1699014675.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 0000000E.00000002.1708989485.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 0000001A.00000000.1761926509.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, BraveUpdate.exe, 0000002B.00000002.2059249803.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, GUT4669.tmp.0.dr, BraveUpdate.exe.1.dr
Source: Binary string: goopdateres_unsigned_hr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F2A000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659650073.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659494915.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659716512.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_hr.dll.1.dr, goopdateres_hr.dll.0.dr
Source: Binary string: goopdateres_unsigned_id.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F45000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003752000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660307251.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660105918.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660240144.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_id.dll.0.dr
Source: Binary string: psuser_unsigned_64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1671867210.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_zh-TW.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003902000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000002.2425248649.0000000000AEE000.00000004.00000010.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1670815170.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveCrashHandlerArm64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647230921.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647181654.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveCrashHandler64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646526547.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveUpdateCore_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645947698.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646134207.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646182867.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, BraveUpdateCore.exe.1.dr
Source: Binary string: BraveCrashHandler_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646436390.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646477064.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646246445.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveCrashHandler.exe.0.dr, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_sw.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003888000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000307C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1668871555.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveCrashHandler64_unsigned.pdb~ source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646526547.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_it.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F60000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000376D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1661510212.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660791109.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1661014960.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_pt-PT.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000300A000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000301D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666722472.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666855072.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666944474.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_pt-PT.dll.1.dr
Source: Binary string: goopdateres_unsigned_vi.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038E8000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030DB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1670380085.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_bn.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E42000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000364F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649100466.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649357847.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649278373.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_bn.dll.0.dr
Source: Binary string: BraveUpdateBroker_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1676019920.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1675639471.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1676251852.000000000102D000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, BraveUpdateBroker.exe.1.dr
Source: Binary string: goopdateres_unsigned_ja.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F69000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F7C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662200664.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662281197.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1661934489.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_ja.dll.0.dr
Source: Binary string: goopdateres_unsigned_sv.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000387B000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000306E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1668696033.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_sv.dll.1.dr
Source: Binary string: goopdateres_unsigned_es.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EB0000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036BD000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652663029.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652741088.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652326172.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_es.dll.0.dr
Source: Binary string: psmachine_unsigned_64.pdbG source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1672813816.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveUpdateCore_unsigned.pdbW source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645947698.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646134207.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1646182867.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, BraveUpdateCore.exe.1.dr
Source: Binary string: goopdateres_unsigned_is.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003760000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660570940.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660629376.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660429527.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_fr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F01000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000370E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1658198876.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1657850418.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1658308545.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_uk.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.00000000030AE000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1669840480.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_ro.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003837000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.000000000302A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667117339.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667269812.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667339932.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_ca.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E3E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E50000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649500615.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649748795.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1649683028.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psmachine_unsigned_arm64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1673085727.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, psmachine_arm64.dll.1.dr, psmachine_arm64.dll.0.dr
Source: Binary string: goopdateres_unsigned_nl.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002FD4000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665230201.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665492995.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665407178.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_ko.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F83000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662994342.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662822293.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663089936.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_ko.dll.1.dr
Source: Binary string: goopdateres_unsigned_et.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1654347196.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1654252412.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1653571590.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveUpdateComRegisterShellArm64_unsigned.pdbW source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647700395.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647929197.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647877869.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_no.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003801000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665800212.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665608088.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1665879303.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_te.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000003085000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003097000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1669260943.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_iw.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000377B000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1661728255.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1661601404.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1661796688.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_iw.dll.0.dr
Source: Binary string: goopdateres_unsigned_ur.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030CE000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038DA000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1670164253.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_ur.dll.0.dr
Source: Binary string: goopdateres_unsigned_fil.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EF3000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1656978587.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1656618421.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1657306499.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdate_unsigned.pdbz source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645793767.00000000043F1000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_pl.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003002000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000380E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666003809.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666168843.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1666254244.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_pl.dll.1.dr
Source: Binary string: goopdateres_unsigned_en-GB.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036AF000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EA2000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652148182.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652004801.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1652225654.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_ml.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002FBD000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1663877909.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1664044982.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1664133200.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psuser_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1671440640.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_fi.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1656305564.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1655694662.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1656116668.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_sk.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000003033000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003046000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667775535.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1667932618.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1668008216.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_hu.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F26000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1660013732.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659955501.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1659804771.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: BraveUpdateOnDemand_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1676988072.000000000102D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1676712899.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1676428744.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateOnDemand.exe, 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 0000000D.00000000.1703756956.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 00000019.00000000.1761241224.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 00000019.00000002.1763432229.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 0000002A.00000002.2058115467.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 0000002A.00000000.2054584520.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 0000002F.00000000.2120037936.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, BraveUpdateOnDemand.exe, 0000002F.00000002.2122646917.0000000000C5E000.00000002.00000001.01000000.00000010.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psmachine_unsigned.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1672552392.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_en.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E95000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1651568122.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000002.2413157352.0000000000FB0000.00000002.00000001.00040000.0000001C.sdmp, BraveUpdate.exe, 00000001.00000003.1651857943.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1651789398.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000002.00000002.1680615804.0000000000EA0000.00000002.00000001.00040000.0000000A.sdmp, BraveUpdate.exe, 00000007.00000002.1694614219.0000000000B90000.00000002.00000001.00040000.0000000A.sdmp, BraveUpdate.exe, 0000000B.00000002.2381519448.00000000013D0000.00000002.00000001.00040000.0000000A.sdmp, BraveUpdate.exe, 0000000C.00000002.2428277164.0000000001840000.00000002.00000001.00040000.0000000A.sdmp, BraveUpdate.exe, 0000000E.00000002.1708712100.0000000000810000.00000002.00000001.00040000.0000000A.sdmp, BraveUpdate.exe, 0000001A.00000002.1810659158.00000000011A0000.00000002.00000001.00040000.0000000A.sdmp, BraveUpdate.exe, 0000002B.00000002.2059688594.0000000001310000.00000002.00000001.00040000.0000000A.sdmp, GUT4669.tmp.0.dr, goopdateres_en.dll.0.dr
Source: Binary string: goopdateres_unsigned_da.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E6C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650140167.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650286286.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1650358401.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_da.dll.0.dr
Source: Binary string: BraveUpdateComRegisterShellArm64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647700395.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647929197.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1647877869.0000000001052000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: psmachine_unsigned_64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1672813816.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_ar.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002E16000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002E28000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648537831.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648617305.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1648356005.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr, goopdateres_ar.dll.0.dr
Source: Binary string: goopdateres_unsigned_sl.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.0000000003860000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000003053000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1668110214.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_zh-CN.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.00000000038F5000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.00000000030E8000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1670572756.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: Binary string: goopdateres_unsigned_kn.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002F89000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.0000000002F76000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662374811.0000000001042000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662586702.0000000001052000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1662696270.0000000001042000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.dr
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682C3A10 LoadLibraryW,GetProcAddress,FreeLibrary,4_2_00007FF7682C3A10
Source: BraveUpdateSetup.exe.1.drStatic PE information: real checksum: 0x165c94 should be: 0x1621a3
Source: BraveUpdateSetup.exe.0.drStatic PE information: real checksum: 0x165c94 should be: 0x1621a3
Source: BraveBrowserSetup-BRV002.exeStatic PE information: real checksum: 0x165c94 should be: 0x1621a3
Source: BraveUpdateComRegisterShell64.exe.0.drStatic PE information: section name: _RDATA
Source: psmachine.dll.0.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.0.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.0.drStatic PE information: section name: _RDATA
Source: psuser.dll.0.drStatic PE information: section name: .orpc
Source: psuser_64.dll.0.drStatic PE information: section name: .orpc
Source: psuser_64.dll.0.drStatic PE information: section name: _RDATA
Source: BraveCrashHandler64.exe.0.drStatic PE information: section name: _RDATA
Source: psmachine_arm64.dll.0.drStatic PE information: section name: .orpc
Source: psuser_arm64.dll.0.drStatic PE information: section name: .orpc
Source: psuser.dll.1.drStatic PE information: section name: .orpc
Source: psuser_64.dll.1.drStatic PE information: section name: .orpc
Source: psuser_64.dll.1.drStatic PE information: section name: _RDATA
Source: psuser_arm64.dll.1.drStatic PE information: section name: .orpc
Source: psmachine.dll.1.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.1.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.1.drStatic PE information: section name: _RDATA
Source: psmachine_arm64.dll.1.drStatic PE information: section name: .orpc
Source: BraveCrashHandler64.exe.1.drStatic PE information: section name: _RDATA
Source: BraveUpdateComRegisterShell64.exe.1.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008E8226 push ecx; ret 0_2_008E8239
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCode function: 1_2_003E4346 push ecx; ret 1_2_003E4359
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009E4346 push ecx; ret 2_2_009E4359
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 13_2_00C5CF36 push ecx; ret 13_2_00C5CF49
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 14_2_02D2CE5B push eax; iretd 14_2_02D2CF3D
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 14_2_02D2EEEF pushad ; ret 14_2_02D2EEF9
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 14_2_02D2CF3F push eax; iretd 14_2_02D2CF45
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 14_2_02D2F02C pushad ; ret 14_2_02D2F02D
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 26_2_0335CF34 pushad ; iretd 26_2_0335CF35
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 26_2_0335ED20 pushad ; ret 26_2_0335ED21
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 26_2_0335CED6 pushfd ; iretd 26_2_0335CF0D
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 26_2_0335C2C0 push 540335C3h; ret 26_2_0335C2C9
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 43_2_037DCA7C push esp; retf 43_2_037DCA95
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 43_2_037DEEDC pushad ; ret 43_2_037DEEE5
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 43_2_037DEDB0 pushad ; ret 43_2_037DEDB1
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psuser.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_cs.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sk.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ur.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_en-GB.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShellArm64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ur.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_cs.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ml.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sv.dllJump to dropped file
Source: C:\Windows\System32\svchost.exeFile created: C:\Users\user\AppData\Local\Temp\{EA1E0980-B396-4668-911E-C8E8FC8F4896}-brave_installer-x64.exe (copy)Jump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdate.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateBroker.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sv.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sk.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_it.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_tr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ca.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_nl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ro.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdate.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psmachine.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\CR_CCCBE.tmp\setup.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_it.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdate.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_en-GB.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psmachine_arm64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_vi.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_nl.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ro.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_hi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_tr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser_arm64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_es.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_hr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_vi.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandlerArm64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pl.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_id.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fil.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_iw.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_te.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_bn.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_es.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_bg.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_mr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_et.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_da.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ja.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateSetup.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_de.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_uk.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_th.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fa.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\Download\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\122.1.63.174\brave_installer-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psuser_64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ms.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_el.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_hu.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_en.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_kn.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ko.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ml.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_no.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ko.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_is.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser_64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_am.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateComRegisterShell64.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_lv.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_es-419.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_is.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_gu.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hu.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_th.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ta.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_am.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ru.dllJump to dropped file
Source: C:\Windows\System32\svchost.exeFile created: C:\Users\user\AppData\Local\Temp\BIT544.tmpJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateCore.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_de.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ta.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandlerArm64.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ru.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psmachine_64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_id.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_lv.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_et.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_iw.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fil.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_pl.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine_arm64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateSetup.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fi.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ja.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_no.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandler64.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psuser_arm64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_mr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_bg.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateComRegisterShellArm64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandler.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_uk.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine_64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_te.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_el.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ms.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateOnDemand.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandler.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateBroker.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ca.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fa.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_da.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_kn.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandler64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_bn.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateCore.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_en.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_es-419.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682C44A8 RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,4_2_00007FF7682C44A8

Boot Survival

barindex
Creates an undocumented autostart registry key
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe DisableExceptionChainValidationJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe DisableExceptionChainValidationJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe DisableExceptionChainValidationJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Found evasive API chain (may stop execution after checking volume information)
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exeEvasive API call chain: GetVolumeInformation,DecisionNodes,ExitProcess
Found evasive API chain checking for user administrative privileges
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCheck user administrative privileges: IsUserAndAdmin, DecisionNodegraph_0-13223
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psuser.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_cs.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sk.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ur.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShellArm64.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_en-GB.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ur.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_cs.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ml.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sv.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdate.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateBroker.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sv.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sk.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_it.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_tr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ca.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_nl.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ro.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdate.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psmachine.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\CR_CCCBE.tmp\setup.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_it.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_en-GB.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_vi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psmachine_arm64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_nl.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ro.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_hi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_tr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser_arm64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_hr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_vi.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandlerArm64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pl.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_id.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fil.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_iw.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_te.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_bn.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_bg.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_mr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_et.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_da.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ja.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_de.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_uk.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_th.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fa.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psuser_64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ms.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_el.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_hu.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_en.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ko.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_kn.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ml.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_no.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ko.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_is.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser_64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_am.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_lv.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_es-419.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_is.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_gu.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hu.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ta.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_th.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_am.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ru.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateCore.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_de.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ta.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandlerArm64.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ru.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_id.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psmachine_64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_lv.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_et.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_iw.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fil.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine_arm64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_pl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fi.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ja.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_no.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandler64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_bg.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psuser_arm64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_mr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateComRegisterShellArm64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandler.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine_64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_uk.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_el.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_te.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ms.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandler.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fa.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateBroker.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ca.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_da.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_kn.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandler64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_bn.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_en.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateCore.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_es-419.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sl.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exeEvasive API call chain: RegOpenKey,DecisionNodes,ExitProcess
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeAPI coverage: 9.1 %
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe TID: 3196Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe TID: 5516Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7164Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCode function: 1_2_003DD9B3 FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_003DD9B3
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009DD9B3 FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_009DD9B3
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682D1D68 FindFirstFileExW,4_2_00007FF7682D1D68
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 13_2_00C56405 FindFirstFileExW,13_2_00C56405
Source: BraveUpdate.exe, 00000001.00000003.2382536859.0000000001067000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: BraveUpdate.exe, 0000000C.00000002.2426869012.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2398517429.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2409726495.0000000000F72000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0
Source: BraveUpdate.exe, 0000000A.00000003.1704442118.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000002.1707390457.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000003.1704698234.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000003.1704856537.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2398517429.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000002.2427386217.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1921001030.000002E95CE1C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CE14000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876669990.000002E95CDC0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2874009639.000002E95A091000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: iexplore.exe, 0000000F.00000003.1892783640.000002E95CEC6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: BraveUpdate.exe, 0000000A.00000003.1704616690.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000002.1707232865.0000000000D91000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWh
Source: svchost.exe, 00000011.00000002.2874337170.000001592F22B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW l
Source: BraveUpdate.exe, 00000001.00000003.2382536859.0000000001067000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\l#u
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008DDA04 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_008DDA04
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682C4CE8 InitializeCriticalSectionAndSpinCount,GetLastError,IsDebuggerPresent,OutputDebugStringW,4_2_00007FF7682C4CE8
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682C3A10 LoadLibraryW,GetProcAddress,FreeLibrary,4_2_00007FF7682C3A10
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008DA026 mov ecx, dword ptr fs:[00000030h]0_2_008DA026
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008DF38C mov eax, dword ptr fs:[00000030h]0_2_008DF38C
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCode function: 1_2_003DD6A1 mov eax, dword ptr fs:[00000030h]1_2_003DD6A1
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCode function: 1_2_003DBEF8 mov ecx, dword ptr fs:[00000030h]1_2_003DBEF8
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009DD6A1 mov eax, dword ptr fs:[00000030h]2_2_009DD6A1
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009DBEF8 mov ecx, dword ptr fs:[00000030h]2_2_009DBEF8
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 13_2_00C54C52 mov ecx, dword ptr fs:[00000030h]13_2_00C54C52
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 13_2_00C5726A mov eax, dword ptr fs:[00000030h]13_2_00C5726A
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008D11D5 GetProcessHeap,__Init_thread_footer,__Init_thread_footer,0_2_008D11D5
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess token adjusted: Debug
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess token adjusted: Debug
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008D7190 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_008D7190
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008DDA04 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_008DDA04
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008D6D06 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_008D6D06
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008D6E9A SetUnhandledExceptionFilter,0_2_008D6E9A
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCode function: 1_2_003DB83E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_003DB83E
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCode function: 1_2_003D7D47 SetUnhandledExceptionFilter,1_2_003D7D47
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCode function: 1_2_003D7A8E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_003D7A8E
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeCode function: 1_2_003D7BB0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_003D7BB0
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009DB83E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_009DB83E
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009D7D47 SetUnhandledExceptionFilter,2_2_009D7D47
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009D7A8E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_009D7A8E
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009D7BB0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_009D7BB0
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682C5994 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF7682C5994
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682C5B78 SetUnhandledExceptionFilter,4_2_00007FF7682C5B78
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682CB4C8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF7682CB4C8
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF7682C55DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF7682C55DC
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 13_2_00C51850 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,13_2_00C51850
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 13_2_00C519E4 SetUnhandledExceptionFilter,13_2_00C519E4
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 13_2_00C55D94 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,13_2_00C55D94
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 13_2_00C51AF5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,13_2_00C51AF5

HIPS / PFW / Operating System Protection Evasion

barindex
Benign windows process drops PE files
Source: C:\Windows\System32\svchost.exeFile created: BIT544.tmp.17.drJump to dropped file
Maps a DLL or memory area into another process
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeSection loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{9572EB9C-CAE5-4198-B3D9-281703937DC9}Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "c:\program files (x86)\bravesoftware\update\braveupdate.exe" /ping pd94bwwgdmvyc2lvbj0ims4wiiblbmnvzgluzz0ivvrgltgipz48cmvxdwvzdcbwcm90b2nvbd0imy4wiib1cgrhdgvypsjpbwfoysigdxbkyxrlcnzlcnnpb249ijeumy4znjeumtq1iibzagvsbf92zxjzaw9upsixljmumzyxlje0nsigaxntywnoaw5lpsixiibzzxnzaw9uawq9ins5ntcyrui5qy1dquu1ltqxotgtqjneos0yode3mdm5mzdeqzl9iibpbnn0ywxsc291cmnlpsj0ywdnzwrtasigdgvzdhnvdxjjzt0iyxv0byigcmvxdwvzdglkpsj7qki0ote1ouqtmjixni00mkq4luffrtatrtg3ndaxoeq5rda1fsigzgvkdxa9imnyiibkb21haw5qb2luzwq9ijaipjxodybwahlzbwvtb3j5psi4iibzc2u9ijeiihnzzti9ijeiihnzztm9ijeiihnzc2uzpsixiibzc2u0mt0imsigc3nlndi9ijeiigf2ed0imsivpjxvcybwbgf0zm9ybt0id2luiib2zxjzaw9upsixmc4wlje5mdq1ljiwmdyiihnwpsiiigfyy2g9ing2ncivpjxhchagyxbwawq9intcmtmxqzkzns05qku2ltqxreetotu5os0xrjc3nkjfqjgwmtl9iib2zxjzaw9upsiiig5lehr2zxjzaw9upsixljmumzyxlje0nsigbgfuzz0iiibicmfuzd0iiibjbgllbnq9iii-pgv2zw50igv2zw50dhlwzt0imiigzxzlbnryzxn1bhq9ijeiigvycm9yy29kzt0imcigzxh0cmfjb2rlmt0imcigaw5zdgfsbf90aw1lx21zpsi1nda2ii8-pc9hcha-pc9yzxf1zxn0pg
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe c:\program files (x86)\bravesoftware\update\braveupdate.exe" /handoff "appguid={afe6a462-c574-4b8a-af43-4cc60df4563b}&appname=brave-release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{9572eb9c-cae5-4198-b3d9-281703937dc9}
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "c:\program files (x86)\bravesoftware\update\braveupdate.exe" /ping pd94bwwgdmvyc2lvbj0ims4wiiblbmnvzgluzz0ivvrgltgipz48cmvxdwvzdcbwcm90b2nvbd0imy4wiib1cgrhdgvypsjpbwfoysigdxbkyxrlcnzlcnnpb249ijeumy4znjeumtq1iibzagvsbf92zxjzaw9upsixljmumzyxlje0nsigaxntywnoaw5lpsixiibzzxnzaw9uawq9ins5ntcyrui5qy1dquu1ltqxotgtqjneos0yode3mdm5mzdeqzl9iibpbnn0ywxsc291cmnlpsj0ywdnzwrtasigdgvzdhnvdxjjzt0iyxv0byigcmvxdwvzdglkpsj7qki0ote1ouqtmjixni00mkq4luffrtatrtg3ndaxoeq5rda1fsigzgvkdxa9imnyiibkb21haw5qb2luzwq9ijaipjxodybwahlzbwvtb3j5psi4iibzc2u9ijeiihnzzti9ijeiihnzztm9ijeiihnzc2uzpsixiibzc2u0mt0imsigc3nlndi9ijeiigf2ed0imsivpjxvcybwbgf0zm9ybt0id2luiib2zxjzaw9upsixmc4wlje5mdq1ljiwmdyiihnwpsiiigfyy2g9ing2ncivpjxhchagyxbwawq9intcmtmxqzkzns05qku2ltqxreetotu5os0xrjc3nkjfqjgwmtl9iib2zxjzaw9upsiiig5lehr2zxjzaw9upsixljmumzyxlje0nsigbgfuzz0iiibicmfuzd0iiibjbgllbnq9iii-pgv2zw50igv2zw50dhlwzt0imiigzxzlbnryzxn1bhq9ijeiigvycm9yy29kzt0imcigzxh0cmfjb2rlmt0imcigaw5zdgfsbf90aw1lx21zpsi1nda2ii8-pc9hcha-pc9yzxf1zxn0pgJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe c:\program files (x86)\bravesoftware\update\braveupdate.exe" /handoff "appguid={afe6a462-c574-4b8a-af43-4cc60df4563b}&appname=brave-release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{9572eb9c-cae5-4198-b3d9-281703937dc9}Jump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008D6FA5 cpuid 0_2_008D6FA5
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_008D6BF6 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_008D6BF6
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe DisableExceptionChainValidationJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts14
Command and Scripting Interpreter		1
Scheduled Task/Job		111
Process Injection		12
Masquerading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Scheduled Task/Job		11
Registry Run Keys / Startup Folder		1
Scheduled Task/Job		2
Virtualization/Sandbox Evasion		LSASS Memory1
Query Registry		Remote Desktop Protocol2
Clipboard Data		1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts231
Native API		1
DLL Side-Loading		11
Registry Run Keys / Startup Folder		1
Disable or Modify Tools		Security Account Manager41
Security Software Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts11
Exploitation for Client Execution		1
Image File Execution Options Injection		1
DLL Side-Loading		111
Process Injection		NTDS2
Virtualization/Sandbox Evasion		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
Image File Execution Options Injection		1
Deobfuscate/Decode Files or Information		LSA Secrets1
Process Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
Obfuscated Files or Information		Cached Domain Credentials1
Account Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
DLL Side-Loading		DCSync2
File and Directory Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem133
System Information Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1408821 Sample: BraveBrowserSetup-BRV002.exe Startdate: 14/03/2024 Architecture: WINDOWS Score: 51 151 Found evasive API chain (may stop execution after checking volume information) 2->151 153 Downloads suspicious files via Chrome 2->153 10 BraveBrowserSetup-BRV002.exe 1 79 2->10         started        14 BraveUpdateOnDemand.exe 2->14         started        16 svchost.exe 2->16         started        19 8 other processes 2->19 process3 dnsIp4 103 C:\Program Files (x86)\...\BraveUpdate.exe, PE32 10->103 dropped 105 C:\Program Files (x86)\...\psuser_arm64.dll, PE32+ 10->105 dropped 107 C:\Program Files (x86)\...\psuser_64.dll, PE32+ 10->107 dropped 117 69 other files (none is malicious) 10->117 dropped 159 Found evasive API chain checking for user administrative privileges 10->159 21 BraveUpdate.exe 17 78 10->21         started        25 BraveUpdate.exe 14->25         started        119 108.139.47.112 AMAZON-02US United States 16->119 121 69.192.108.161 AKAMAI-ASUS United States 16->121 123 127.0.0.1 unknown unknown 16->123 109 {EA1E0980-B396-466...ller-x64.exe (copy), PE32+ 16->109 dropped 111 C:\Users\user\AppData\Local\Temp\BIT544.tmp, PE32+ 16->111 dropped 161 Benign windows process drops PE files 16->161 113 C:\...\brave_installer-x64.exe, PE32+ 19->113 dropped 115 C:\...\brave_installer-x64.exe, PE32+ 19->115 dropped 27 BraveUpdate.exe 19->27         started        29 BraveUpdate.exe 19->29         started        31 brave_installer-x64.exe 19->31         started        33 3 other processes 19->33 file5 signatures6 process7 file8 93 C:\Program Files (x86)\...\BraveUpdate.exe, PE32 21->93 dropped 95 C:\Program Files (x86)\...\psuser_arm64.dll, PE32+ 21->95 dropped 97 C:\Program Files (x86)\...\psuser_64.dll, PE32+ 21->97 dropped 101 70 other files (none is malicious) 21->101 dropped 157 Creates an undocumented autostart registry key 21->157 35 BraveUpdate.exe 206 21->35         started        37 BraveUpdate.exe 21->37         started        40 BraveUpdate.exe 52 21->40         started        42 BraveUpdate.exe 21->42         started        44 iexplore.exe 25->44         started        46 iexplore.exe 27->46         started        48 iexplore.exe 29->48         started        99 C:\Program Files (x86)\...\setup.exe, PE32+ 31->99 dropped signatures9 process10 dnsIp11 50 BraveUpdateComRegisterShell64.exe 6 35->50         started        52 BraveUpdateComRegisterShell64.exe 6 35->52         started        54 BraveUpdateComRegisterShell64.exe 87 35->54         started        127 13.225.214.110 AMAZON-02US United States 37->127 129 13.107.21.200 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 44->129 56 ie_to_edge_stub.exe 44->56         started        58 iexplore.exe 44->58         started        61 iexplore.exe 44->61         started        63 4 other processes 44->63 process12 dnsIp13 65 msedge.exe 56->65         started        131 23.51.57.215 TMNET-AS-APTMNetInternetServiceProviderMY United States 58->131 133 18.164.96.83 MIT-GATEWAYSUS United States 58->133 139 6 other IPs or domains 58->139 70 ie_to_edge_stub.exe 58->70         started        72 ssvagent.exe 58->72         started        135 23.43.85.42 GTT-BACKBONEGTTDE United States 61->135 141 4 other IPs or domains 61->141 74 ssvagent.exe 61->74         started        137 20.189.173.13 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 63->137 143 4 other IPs or domains 63->143 process14 dnsIp15 125 239.255.255.250 unknown Reserved 65->125 85 C:\Users\user\...\page_embed_script.js, ASCII 65->85 dropped 87 C:\Users\user\...\eventpage_bin_prod.js, ASCII 65->87 dropped 89 C:\Users\user\AppData\...\content_new.js, Unicode 65->89 dropped 91 C:\Users\user\AppData\Local\...\content.js, Unicode 65->91 dropped 155 Maps a DLL or memory area into another process 65->155 76 msedge.exe 65->76         started        79 msedge.exe 65->79         started        81 identity_helper.exe 65->81         started        83 identity_helper.exe 65->83         started        file16 signatures17 process18 dnsIp19 145 13.107.21.239 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 76->145 147 13.107.213.40 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 76->147 149 9 other IPs or domains 76->149

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
BraveBrowserSetup-BRV002.exe3%ReversingLabs
BraveBrowserSetup-BRV002.exe1%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandler.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandler.exe0%VirustotalBrowse
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandler64.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandler64.exe0%VirustotalBrowse
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandlerArm64.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandlerArm64.exe0%VirustotalBrowse
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe1%VirustotalBrowse
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateBroker.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateBroker.exe0%VirustotalBrowse
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateComRegisterShell64.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateComRegisterShellArm64.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateCore.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateOnDemand.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateSetup.exe3%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdate.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_am.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ar.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_bg.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_bn.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ca.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_cs.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_da.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_de.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_el.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_en-GB.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_en.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_es-419.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_es.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_et.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fa.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fi.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fil.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fr.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_gu.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_hi.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_hr.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_hu.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_id.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_is.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_it.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_iw.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ja.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_kn.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ko.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_lt.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_lv.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ml.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_mr.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ms.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_nl.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_no.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_pl.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_pt-BR.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_pt-PT.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ro.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ru.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sk.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sl.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sr.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sv.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sw.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://deff.nelreports.net/api/report?cat=msn0%URL Reputationsafe
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS5f0%Avira URL Cloudsafe
http://search.yahoo.co.jp40%Avira URL Cloudsafe
https://updates.bravesoftware.com/service/update20%Avira URL Cloudsafe
http://www.mercadolivre.com.br/0%Avira URL Cloudsafe
http://www.merlin.com.pl/favicon.ico0%Avira URL Cloudsafe
http://busca.uol.com.br/m0%Avira URL Cloudsafe
http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation=ItemSea0%Avira URL Cloudsafe
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW0%Avira URL Cloudsafe
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS60%Avira URL Cloudsafe
http://www.merlin.com.pl/favicon.ico0%VirustotalBrowse
http://busca.igbusca.com.br//app/static/images/favicon.ico0%Avira URL Cloudsafe
http://www.etmall.com.tw/favicon.ico0%Avira URL Cloudsafe
http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation=ItemSea0%VirustotalBrowse
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW0%VirustotalBrowse
http://busca.uol.com.br/m0%VirustotalBrowse
http://it.search.dada.net/favicon.ico0%Avira URL Cloudsafe
http://busca.igbusca.com.br//app/static/images/favicon.ico0%VirustotalBrowse
http://search.hanafos.com/favicon.ico0%Avira URL Cloudsafe
http://cgi.search.biglobe.ne.jp/favicon.ico0%Avira URL Cloudsafe
http://www.etmall.com.tw/favicon.ico0%VirustotalBrowse
http://crl.ver)0%Avira URL Cloudsafe
https://updates.bravesoftware.com/service/update20%VirustotalBrowse
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS60%VirustotalBrowse
http://www.mercadolivre.com.br/0%VirustotalBrowse
http://search.msn.co.jp/results.aspx?q=0%Avira URL Cloudsafe
http://buscar.ozu.es/0%Avira URL Cloudsafe
http://search.auction.co.kr/0%Avira URL Cloudsafe
http://search.atlas.cz/X0%Avira URL Cloudsafe
https://updates.bravesoftware.com:443/service/update20%Avira URL Cloudsafe
http://search.msn.co.jp/results.aspx?q=0%VirustotalBrowse
http://search.hanafos.com/favicon.ico0%VirustotalBrowse
http://it.search.dada.net/favicon.ico0%VirustotalBrowse
http://search.auction.co.kr/0%VirustotalBrowse
http://www.pchome.com.tw/favicon.ico0%Avira URL Cloudsafe
http://browse.guardian.co.uk/favicon.ico0%Avira URL Cloudsafe
http://google.pchome.com.tw/0%Avira URL Cloudsafe
http://busca.igbusca.com.br/10%Avira URL Cloudsafe
http://cgi.search.biglobe.ne.jp/favicon.ico0%VirustotalBrowse
http://browse.guardian.co.uk/favicon.ico0%VirustotalBrowse
https://updates.bravesoftware.com:443/service/update20%VirustotalBrowse
http://google.pchome.com.tw/0%VirustotalBrowse
http://buscador.terra.com.br/I0%Avira URL Cloudsafe
http://www.ozu.es/favicon.ico0%Avira URL Cloudsafe
http://search.yahoo.co.jp/favicon.ico0%Avira URL Cloudsafe
http://www.ozu.es/favicon.ico0%VirustotalBrowse
http://buscar.ozu.es/0%VirustotalBrowse
http://www.gmarket.co.kr/0%Avira URL Cloudsafe
http://www.rakuten.co.jp/favicon.icoZ0%Avira URL Cloudsafe
https://updates.bravesoftware.com/service/check2/recover&appid=%s&appversion=%s&applang=%s&machine=%0%Avira URL Cloudsafe
http://search.orange.co.uk/favicon.ico0%Avira URL Cloudsafe
http://search.yahoo.co.jp/favicon.ico0%VirustotalBrowse
http://www.iask.com/0%Avira URL Cloudsafe
http://service2.bfast.com/0%Avira URL Cloudsafe
http://img.atlas.cz/favicon.icoy0%Avira URL Cloudsafe
https://updates.bravesoftware.com/service/check2/recover&appid=%s&appversion=%s&applang=%s&machine=%0%VirustotalBrowse
http://search.orange.co.uk/favicon.ico0%VirustotalBrowse
http://www.pchome.com.tw/favicon.ico0%VirustotalBrowse
http://www.iask.com/0%VirustotalBrowse
http://www.gmarket.co.kr/0%VirustotalBrowse
http://www.news.com.au/favicon.ico0%Avira URL Cloudsafe
http://www.rakuten.co.jp/favicon.icoZ0%VirustotalBrowse
http://buscador.terra.com.br/I0%VirustotalBrowse
http://service2.bfast.com/0%VirustotalBrowse
http://www.news.com.au/favicon.ico0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://www.msn.com/favicon.icoYc0iexplore.exe, 0000000F.00000002.2880171716.000002E96029E000.00000004.00000020.00020000.00000000.sdmpfalse
    		high
    https://www.hollywoodreporter.com/tv/tv-news/robyn-bernard-dead-general-hospital-actress-1235852051/me[1].json.28.drfalse
      		high
      http://search.chol.com/favicon.icoiexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        http://www.mercadolivre.com.br/iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
        • 0%, Virustotal, Browse
        • Avira URL Cloud: safe
        		unknown
        https://www.msn.com/.iexplore.exe, 0000000F.00000002.2879568803.000002E9601F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          http://www.merlin.com.pl/favicon.icoiexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
          • 0%, Virustotal, Browse
          • Avira URL Cloud: safe
          		unknown
          http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS5fiexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://www.msn.com/?ocid=iehpah-iexplore.exe, 0000000F.00000002.2880896248.000002E9604AC000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or-darkme[1].json.28.drfalse
              		high
              https://www.msn.com/favicon.ico/iexplore.exe, 0000000F.00000002.2880896248.000002E960566000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2884160169.000002E962F3F000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://www.msn.com/?ocid=iehpQYiexplore.exe, 0000000F.00000002.2876669990.000002E95CD67000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://deff.nelreports.net/api/report?cat=msniexplore.exe, 0000000F.00000003.1919880394.000002E96028A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1916013453.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1923622981.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://search.yahoo.co.jp4iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://updates.bravesoftware.com/service/update2BraveUpdate.exe, 0000000A.00000003.1704442118.0000000000DB2000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000002.2426674497.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2404600749.0000000000F40000.00000004.00000020.00020000.00000000.sdmpfalse
                  • 0%, Virustotal, Browse
                  • Avira URL Cloud: safe
                  		unknown
                  http://busca.uol.com.br/miexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                  • 0%, Virustotal, Browse
                  • Avira URL Cloud: safe
                  		unknown
                  http://fr.search.yahoo.com/iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://docs.google.com/manifest.json.22.drfalse
                      		high
                      https://g.live.com/odclientsettings/Prod.C:svchost.exe, 00000011.00000003.1714001746.0000015934AFF000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://in.search.yahoo.com/iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://www.msn.com/favicon.ico:dQiexplore.exe, 0000000F.00000003.1915878658.000002E96029D000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            http://img.shopzilla.com/shopzilla/shopzilla.icoiexplore.exe, 0000000F.00000003.1802116979.000002E95CC26000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation=ItemSeaiexplore.exe, 0000000F.00000003.1802116979.000002E95CC26000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpfalse
                              • 0%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              https://www.msn.com/favicon.icoZiexplore.exe, 0000000F.00000002.2880896248.000002E960566000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=CBPWiexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                • 0%, Virustotal, Browse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.msn.com/favicon.icoXiexplore.exe, 0000000F.00000002.2876669990.000002E95CE14000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.msn.com/favicon.icoSiexplore.exe, 0000000F.00000002.2876669990.000002E95CE14000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS6iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • 0%, Virustotal, Browse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://search.aol.com/piexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://msk.afisha.ru/iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://wns.windows.com/iexplore.exe, 0000000F.00000002.2876669990.000002E95CD67000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.paginasamarillas.es/favicon.icoJiexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.reddit.com/iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              http://busca.igbusca.com.br//app/static/images/favicon.icoiexplore.exe, 0000000F.00000003.1802116979.000002E95CC26000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • 0%, Virustotal, Browse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.orange.fr/uiexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://www.msn.com/?ocid=iehp/fwlink/p/?LinkId=255141eriexplore.exe, 0000000F.00000003.1892783640.000002E95CE00000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.ya.com/favicon.icoiexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.etmall.com.tw/favicon.icoiexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • 0%, Virustotal, Browse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://it.search.dada.net/favicon.icoiexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • 0%, Virustotal, Browse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://search.hanafos.com/favicon.icoiexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • 0%, Virustotal, Browse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://cgi.search.biglobe.ne.jp/favicon.icoiexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • 0%, Virustotal, Browse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://drive-daily-2.corp.google.com/manifest.json.22.drfalse
                                                      		high
                                                      https://www.msn.com/favicon.icotiexplore.exe, 0000000F.00000002.2880896248.000002E96052F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://search1.taobao.com/niexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://crl.ver)svchost.exe, 00000011.00000002.2877108350.00000159348B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		low
                                                          http://search.msn.co.jp/results.aspx?q=iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • 0%, Virustotal, Browse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://buscar.ozu.es/iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • 0%, Virustotal, Browse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://www.msn.com/favicon.icokiexplore.exe, 0000000F.00000002.2872751827.000000F7076F6000.00000004.00000010.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.ask.com/iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://drive-daily-5.corp.google.com/manifest.json.22.drfalse
                                                                		high
                                                                http://search.live.com/results.aspx?FORM=SOLTDF&q=iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876393859.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.google.it/iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://www.mmamania.com/2024/3/13/24099921/mark-coleman-update-intubated-ufc-vet-somewhat-consciousme[1].json.28.drfalse
                                                                      		high
                                                                      https://www.msn.com/?ocid=iehpv$iexplore.exe, 0000000F.00000002.2880896248.000002E9603E1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://search.auction.co.kr/iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        • 0%, Virustotal, Browse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        http://search.atlas.cz/Xiexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        http://search.ebay.com/favicon.icooiexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://updates.bravesoftware.com:443/service/update2BraveUpdate.exe, 0000000A.00000002.1707124813.0000000000D59000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          • 0%, Virustotal, Browse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          http://video.globo.com/favicon.ico8iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://list.taobao.com/browse/search_visual.htm?n=15&q=iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.pchome.com.tw/favicon.icoiexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • 0%, Virustotal, Browse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://browse.guardian.co.uk/favicon.icoiexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • 0%, Virustotal, Browse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://img.shopzilla.com/shopzilla/shopzilla.ico.iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://google.pchome.com.tw/iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • 0%, Virustotal, Browse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.rambler.ru/favicon.icoiexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://www.msn.com/favicon.ico=diexplore.exe, 0000000F.00000003.1915878658.000002E96029D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://www.msn.com/favicon.icoPo8iexplore.exe, 0000000F.00000003.1915878658.000002E96029D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://uk.search.yahoo.com/iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://www.msn.com/?ocid=iehp-cLiexplore.exe, 0000000F.00000002.2880171716.000002E96029E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://www.msn.com/favicon.ico:Sat:Saturdayiexplore.exe, 0000000F.00000002.2880896248.000002E96052F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://busca.igbusca.com.br/1iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://buscador.terra.com.br/Iiexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • 0%, Virustotal, Browse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://www.ozu.es/favicon.icoiexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • 0%, Virustotal, Browse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://search.sify.com/iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://openimage.interpark.com/interpark.icoiexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://search.yahoo.co.jp/favicon.icoiexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • 0%, Virustotal, Browse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://www.gmarket.co.kr/iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC36000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • 0%, Virustotal, Browse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://search.nifty.com/iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://www.google.si/iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://www.rakuten.co.jp/favicon.icoZiexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      • 0%, Virustotal, Browse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://www.soso.com/iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://updates.bravesoftware.com/service/check2/recover&appid=%s&appversion=%s&applang=%s&machine=%BraveBrowserSetup-BRV002.exe, 00000000.00000003.1627995977.000000000316E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1624618096.000000000294F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1626363017.0000000002941000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1645793767.00000000043F1000.00000004.00000020.00020000.00000000.sdmp, GUT4669.tmp.0.drfalse
                                                                                                        • 0%, Virustotal, Browse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        http://cnweb.search.live.com/results.aspx?q=iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802495083.000002E95CC45000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC46000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRnRme[1].json.28.drfalse
                                                                                                            		high
                                                                                                            http://buscador.lycos.es/Wiexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://www.twitter.com/iexplore.exe, 0000000F.00000003.1915146236.000002E9601F8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://www.msn.com/?ocid=iehp8.100.80iexplore.exe, 0000000F.00000002.2876669990.000002E95CEF2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://search.live.com/results.aspx?q=%7BsearchTerms%7D&src=%7Breferrer:source?%7D&Form=IE8SRCiexplore.exe, 0000000F.00000002.2878382831.000002E95D009000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://search.orange.co.uk/favicon.icoiexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876288092.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    • 0%, Virustotal, Browse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    http://www.iask.com/iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802747670.000002E95CC54000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    • 0%, Virustotal, Browse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    https://www.msn.com/?ocid=iehp.icoiexplore.exe, 0000000F.00000002.2880896248.000002E9603E1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2880896248.000002E9604DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://search.centrum.cz/favicon.icoiexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://service2.bfast.com/iexplore.exe, 0000000F.00000003.1802636431.000002E95CC2D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801846870.000002E95CC27000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802116979.000002E95CC2B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876337903.000002E95CC2E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        • 0%, Virustotal, Browse
                                                                                                                        • Avira URL Cloud: safe
                                                                                                                        		unknown
                                                                                                                        http://img.atlas.cz/favicon.icoyiexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        • Avira URL Cloud: safe
                                                                                                                        		unknown
                                                                                                                        http://ariadna.elmundo.es/iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2878382831.000002E95CFDA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://www.indy100.com/science-tech/mystery-structures-milky-wayme[1].json.28.drfalse
                                                                                                                            		high
                                                                                                                            http://www.news.com.au/favicon.icoiexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            • 0%, Virustotal, Browse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            		unknown
                                                                                                                            http://www.cdiscount.com/iexplore.exe, 0000000F.00000002.2876166636.000002E95CC20000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801978266.000002E95CC1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://it.search.yahoo.com/iexplore.exe, 0000000F.00000003.1802698889.000002E95CC4D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC52000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801886978.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802171405.000002E95CC48000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801760749.000002E95CC3C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://www.ceneo.pl/favicon.icoiexplore.exe, 0000000F.00000003.1802017535.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876393859.000002E95CC43000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000002.2876453100.000002E95CC57000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 0000000F.00000003.1801943388.000002E95CC2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high

                                                                                                                                  World Map of Contacted IPs

                                                                                                                                  • No. of IPs < 25%
                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                  • 75% < No. of IPs

                                                                                                                                  Public IPs

                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                  184.87.173.83
                                                                                                                                  		unknownUnited States
                                                                                                                                  		20940AKAMAI-ASN1EUfalse
                                                                                                                                  204.79.197.200
                                                                                                                                  		unknownUnited States
                                                                                                                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                  104.118.10.106
                                                                                                                                  		unknownUnited States
                                                                                                                                  		16625AKAMAI-ASUSfalse
                                                                                                                                  13.107.21.200
                                                                                                                                  		unknownUnited States
                                                                                                                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                  152.195.19.97
                                                                                                                                  		unknownUnited States
                                                                                                                                  		15133EDGECASTUSfalse
                                                                                                                                  23.51.57.215
                                                                                                                                  		unknownUnited States
                                                                                                                                  		4788TMNET-AS-APTMNetInternetServiceProviderMYfalse
                                                                                                                                  20.189.173.13
                                                                                                                                  		unknownUnited States
                                                                                                                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                  23.43.85.42
                                                                                                                                  		unknownUnited States
                                                                                                                                  		3257GTT-BACKBONEGTTDEfalse
                                                                                                                                  162.159.61.3
                                                                                                                                  		unknownUnited States
                                                                                                                                  		13335CLOUDFLARENETUSfalse
                                                                                                                                  69.192.108.161
                                                                                                                                  		unknownUnited States
                                                                                                                                  		16625AKAMAI-ASUSfalse
                                                                                                                                  108.139.47.92
                                                                                                                                  		unknownUnited States
                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                  104.208.16.91
                                                                                                                                  		unknownUnited States
                                                                                                                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                  13.225.214.110
                                                                                                                                  		unknownUnited States
                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                  13.107.213.40
                                                                                                                                  		unknownUnited States
                                                                                                                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                  204.79.197.239
                                                                                                                                  		unknownUnited States
                                                                                                                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                  20.110.205.119
                                                                                                                                  		unknownUnited States
                                                                                                                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                  151.101.194.137
                                                                                                                                  		unknownUnited States
                                                                                                                                  		54113FASTLYUSfalse
                                                                                                                                  172.64.41.3
                                                                                                                                  		unknownUnited States
                                                                                                                                  		13335CLOUDFLARENETUSfalse
                                                                                                                                  108.139.47.108
                                                                                                                                  		unknownUnited States
                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                  142.250.65.170
                                                                                                                                  		unknownUnited States
                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                  104.71.130.75
                                                                                                                                  		unknownUnited States
                                                                                                                                  		20940AKAMAI-ASN1EUfalse
                                                                                                                                  1.1.1.1
                                                                                                                                  		unknownAustralia
                                                                                                                                  		13335CLOUDFLARENETUSfalse
                                                                                                                                  13.107.21.239
                                                                                                                                  		unknownUnited States
                                                                                                                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                  151.101.65.108
                                                                                                                                  		unknownUnited States
                                                                                                                                  		54113FASTLYUSfalse
                                                                                                                                  13.107.42.16
                                                                                                                                  		unknownUnited States
                                                                                                                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                  239.255.255.250
                                                                                                                                  		unknownReserved
                                                                                                                                  		unknownunknownfalse
                                                                                                                                  18.164.96.83
                                                                                                                                  		unknownUnited States
                                                                                                                                  		3MIT-GATEWAYSUSfalse
                                                                                                                                  108.139.47.112
                                                                                                                                  		unknownUnited States
                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                  104.71.130.49
                                                                                                                                  		unknownUnited States
                                                                                                                                  		20940AKAMAI-ASN1EUfalse
                                                                                                                                  23.209.72.43
                                                                                                                                  		unknownUnited States
                                                                                                                                  		20940AKAMAI-ASN1EUfalse
                                                                                                                                  23.44.201.12
                                                                                                                                  		unknownUnited States
                                                                                                                                  		20940AKAMAI-ASN1EUfalse
                                                                                                                                  142.250.72.110
                                                                                                                                  		unknownUnited States
                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                  204.79.197.203
                                                                                                                                  		unknownUnited States
                                                                                                                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                  142.250.176.193
                                                                                                                                  		unknownUnited States
                                                                                                                                  		15169GOOGLEUSfalse

                                                                                                                                  Private

                                                                                                                                  IP
                                                                                                                                  127.0.0.1

                                                                                                                                  General Information

                                                                                                                                  Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                  Analysis ID:1408821
                                                                                                                                  Start date and time:2024-03-14 09:10:42 +01:00
                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                  Overall analysis duration:0h 11m 24s
                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                  Report type:full
                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                  Number of analysed new started processes analysed:48
                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                  Technologies:
                                                                                                                                  • HCA enabled
                                                                                                                                  • EGA enabled
                                                                                                                                  • AMSI enabled
                                                                                                                                  Analysis Mode:default
                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                  Sample name:BraveBrowserSetup-BRV002.exe
                                                                                                                                  Detection:MAL
                                                                                                                                  Classification:mal51.evad.winEXE@107/553@0/35
                                                                                                                                  EGA Information:
                                                                                                                                  • Successful, ratio: 66.7%
                                                                                                                                  HCA Information:
                                                                                                                                  • Successful, ratio: 95%
                                                                                                                                  • Number of executed functions: 75
                                                                                                                                  • Number of non-executed functions: 110
                                                                                                                                  Cookbook Comments:
                                                                                                                                  • Found application associated with file extension: .exe

                                                                                                                                  Warnings

                                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
                                                                                                                                  • Execution Graph export aborted for target BraveUpdate.exe, PID 3428 because there are no executed function
                                                                                                                                  • Execution Graph export aborted for target BraveUpdate.exe, PID 6320 because there are no executed function
                                                                                                                                  • Execution Graph export aborted for target BraveUpdate.exe, PID 7856 because there are no executed function
                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                  • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                  • Report size getting too big, too many NtDeleteKey calls found.
                                                                                                                                  • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                  • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                  • Report size getting too big, too many NtSetValueKey calls found.
                                                                                                                                  • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                                                                                  • Skipping network analysis since amount of network traffic is too extensive

                                                                                                                                  Simulations

                                                                                                                                  Behavior and APIs

                                                                                                                                  TimeTypeDescription
                                                                                                                                  08:11:34Task SchedulerRun new task: BraveSoftwareUpdateTaskMachineCore{BD1EC347-1BC4-4820-AD59-F666BC47AE10} path: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe s>/c
                                                                                                                                  08:11:34Task SchedulerRun new task: BraveSoftwareUpdateTaskMachineUA{0E0405C1-791F-4358-BFA1-CD78C187A33B} path: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe s>/ua /installsource scheduler
                                                                                                                                  08:11:51AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                                                                  08:12:00AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                                                                  08:12:44AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run BraveVpnWireguardService "C:\Program Files\BraveSoftware\Brave-Browser\Application\122.1.63.174\BraveVpnWireguardService\brave_vpn_wireguard_service.exe" --interactive
                                                                                                                                  09:11:36API Interceptor2x Sleep call for process: BraveUpdate.exe modified
                                                                                                                                  09:11:37API Interceptor2x Sleep call for process: svchost.exe modified

                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                  IPs

                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                  184.87.173.83edge_x86_KB91412024.exeGet hashmaliciousUnknownBrowse
                                                                                                                                    https://kvulhdd75ulw8oeapule.trck81r.ru/84jp/#pip.spence@casa.gov.auGet hashmaliciousUnknownBrowse
                                                                                                                                      https://genericdrugonline.net/?gldbgjya&qrc=dGVzdC50ZXN0MUB0ZXN0LmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                        204.79.197.200kr.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                        • /
                                                                                                                                        13.107.21.200https://www.bing.com/search?q=%e8%8f%af%e7%a2%a9+TUF+GAMING+B760M-PLUS+WIFI%e4%b8%bb%e6%a9%9f%e6%9d%bf&cvid=8ed3431d674542bbaed6934068e7242d&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQABhAMgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBwgJEEUY_FXSAQgxMDUwajBqNKgCALACAA&PC=U531&FPIG=7973DC1DA237417B95A39D883F2961E8&first=121&FORM=PERE2Get hashmaliciousUnknownBrowse
                                                                                                                                          FW EXT Serge Bozhko sent you Air Lease Corporation-VRC CH 12032024 via PandaDoc.msgGet hashmaliciousUnknownBrowse
                                                                                                                                            https://tbyvhszminlmkuuwnrfkaos.s3.eu-west-2.amazonaws.com/url.htmlGet hashmaliciousPhisherBrowse
                                                                                                                                              https://cloudflare-ipfs.comGet hashmaliciousUnknownBrowse
                                                                                                                                                https://prezi.com/i/view/QfiBnVYtk96znGnH43AQGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                  http://213.109.202.222/download/xml.xmlGet hashmaliciousCobaltStrikeBrowse
                                                                                                                                                    I4i6z8T1j9j8N5349890049902.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                      https://www.jabra.com/software-and-services/jabra-directGet hashmaliciousUnknownBrowse
                                                                                                                                                        http://online-aktivierung.com/volks/a1b2c3/e12ffa7c94b1e022bc6fc8a54b52e087/login/?Get hashmaliciousUnknownBrowse
                                                                                                                                                          SEDBK.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                            152.195.19.97https://um.messe-essen-news.de/p/t/nl?t=JI61G.JRAW3.FF5C18DE8E59D9C05531214940DCD87F&d=https://abundantlifetabernaclebx.org#JTNDbWV0YSUyMGh0dHAtZXF1aXYlM0QlMjJyZWZyZXNoJTIyJTIwY29udGVudCUzRCUyMjAlM0IlMjB1cmwlM0RodHRwcyUzQS8vYWxtb3N0YWZhY2xlYW4uY29tLzElMjNtYXJ5Y0BmaW5sZXktY29vay5jb20lMjIlMjAvJTNFGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                              https://1drv.ms/o/s!AmFI0faGJpjZg35FRLRrKG6MdZp9?e=sWdNbFGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                http://a.email8.westpac.com.au/?qqd8UFJGTiJENtWiy-VcqIDuBHhkRyDMq&//mountainspeak.ca/tmp/pxp/mbu/a.b@mbu.eduGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                  FW EXT Serge Bozhko sent you Air Lease Corporation-VRC CH 12032024 via PandaDoc.msgGet hashmaliciousUnknownBrowse
                                                                                                                                                                    https://netorgft14606360-my.sharepoint.com/:b:/g/personal/robertuser_pduserfoundation_org/EWbMjaWtyZZBsYYeh_qoVmUB9UnYwwb8Ml_C3jYLRsA7yg?e=XdsNVhGet hashmaliciousUnknownBrowse
                                                                                                                                                                      Essity Eligible Finance Insurance Benefits Open Enrollment Plan.shtmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                        daticert.xmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                          KY9D34Qh8d.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                            davidloy Eligible Finance Insurance Benefits Open Enrollment Plan.shtmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                              Horvath Otilia Selmanco with you.msgGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                23.51.57.215http://213.109.202.222/download/xml.xmlGet hashmaliciousCobaltStrikeBrowse
                                                                                                                                                                                  web_search_tool (1).docmGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    POSTA CERTIFICATA RE R Oggetto R Wennovia SRL on-site training.msg.cynetGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      Invoice#RV0937.svgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                        http://livespoints.com/sso.dsv.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          https://laser-gravur.cc/uploads/go.php?0g6dcGet hashmaliciousUnknownBrowse

                                                                                                                                                                                            Domains

                                                                                                                                                                                            ⊘No context

                                                                                                                                                                                            ASNs

                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                            MICROSOFT-CORP-MSN-AS-BLOCKUShttps://ecv.microsoft.com/F5w9LBSgNJGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 13.107.246.40
                                                                                                                                                                                            SecuriteInfo.com.ELF.Mirai-AJJ.2909.8691.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                            • 20.125.16.226
                                                                                                                                                                                            SecuriteInfo.com.Trojan.Linux.Mirai.5666.25393.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                            • 21.30.177.134
                                                                                                                                                                                            SecuriteInfo.com.Trojan.Linux.Mirai.1634.8226.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                            • 20.136.244.165
                                                                                                                                                                                            file.exeGet hashmaliciousGlupteba, Mars Stealer, Stealc, VidarBrowse
                                                                                                                                                                                            • 52.168.117.173
                                                                                                                                                                                            https://wanlixing168.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 13.107.246.40
                                                                                                                                                                                            https://mtb-repo.pages.dev/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 52.238.253.184
                                                                                                                                                                                            SecuriteInfo.com.Trojan.PackedNET.2742.9443.15673.exeGet hashmaliciousGlupteba, Mars Stealer, Socks5Systemz, Stealc, VidarBrowse
                                                                                                                                                                                            • 20.189.173.22
                                                                                                                                                                                            Dp2pX5GLaH.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 13.107.213.40
                                                                                                                                                                                            https://lookerstudio.google.com/s/l3M3K3X4dggGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 52.96.87.210
                                                                                                                                                                                            AKAMAI-ASUSfile.exeGet hashmaliciousGlupteba, Mars Stealer, Stealc, VidarBrowse
                                                                                                                                                                                            • 23.196.3.183
                                                                                                                                                                                            SecuriteInfo.com.Trojan.PackedNET.2742.9443.15673.exeGet hashmaliciousGlupteba, Mars Stealer, Socks5Systemz, Stealc, VidarBrowse
                                                                                                                                                                                            • 23.196.3.205
                                                                                                                                                                                            https://www.mlfiqb.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 23.47.168.66
                                                                                                                                                                                            https://www.hrsnqub.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 23.47.168.66
                                                                                                                                                                                            https://www.umqmatj.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 23.47.168.66
                                                                                                                                                                                            https://www.ijpsx.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 23.47.168.66
                                                                                                                                                                                            https://www.jwzxr.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 23.47.168.66
                                                                                                                                                                                            https://www.guedqvr.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 23.52.160.28
                                                                                                                                                                                            wsr3iUW0I0.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, Mars Stealer, PureLog StealerBrowse
                                                                                                                                                                                            • 104.102.129.112
                                                                                                                                                                                            https://www.ydndskh.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 23.47.168.66
                                                                                                                                                                                            AKAMAI-ASN1EUfile.exeGet hashmaliciousGlupteba, Mars Stealer, Stealc, VidarBrowse
                                                                                                                                                                                            • 104.114.73.17
                                                                                                                                                                                            SecuriteInfo.com.Trojan.PackedNET.2742.9443.15673.exeGet hashmaliciousGlupteba, Mars Stealer, Socks5Systemz, Stealc, VidarBrowse
                                                                                                                                                                                            • 23.194.190.171
                                                                                                                                                                                            https://www.guedqvr.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.102.251.161
                                                                                                                                                                                            EXTERNAL New Fax received from eFax - Wednesday 13 March 2024.msgGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                                            • 23.55.243.204
                                                                                                                                                                                            OriginalMessage.txt.msgGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 23.55.243.200
                                                                                                                                                                                            https://assets-usa.mkt.dynamics.com/eafd3d58-f4cb-ee11-9073-6045bd050506/digitalassets/standaloneforms/a5094c23-a3e0-ee11-904c-6045bd02a830Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 23.219.82.81
                                                                                                                                                                                            Kfm25WZ4Y4.rtfGet hashmaliciousRemcosBrowse
                                                                                                                                                                                            • 172.232.8.161
                                                                                                                                                                                            https://www.bing.com/search?q=%e8%8f%af%e7%a2%a9+TUF+GAMING+B760M-PLUS+WIFI%e4%b8%bb%e6%a9%9f%e6%9d%bf&cvid=8ed3431d674542bbaed6934068e7242d&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQABhAMgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBwgJEEUY_FXSAQgxMDUwajBqNKgCALACAA&PC=U531&FPIG=7973DC1DA237417B95A39D883F2961E8&first=121&FORM=PERE2Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 23.200.3.11
                                                                                                                                                                                            https://www.bing.com/search?q=%e8%8f%af%e7%a2%a9+TUF+GAMING+B760M-PLUS+WIFI%e4%b8%bb%e6%a9%9f%e6%9d%bf&cvid=8ed3431d674542bbaed6934068e7242d&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQABhAMgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBwgJEEUY_FXSAQgxMDUwajBqNKgCALACAA&PC=U531&FPIG=7973DC1DA237417B95A39D883F2961E8&first=121&FORM=PERE2Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 23.200.3.5
                                                                                                                                                                                            banka swift 14,302.docx.docGet hashmaliciousRemcosBrowse
                                                                                                                                                                                            • 172.232.8.161
                                                                                                                                                                                            EDGECASTUSfile.exeGet hashmaliciousGlupteba, Mars Stealer, Stealc, VidarBrowse
                                                                                                                                                                                            • 192.229.211.108
                                                                                                                                                                                            SecuriteInfo.com.Trojan.PackedNET.2742.9443.15673.exeGet hashmaliciousGlupteba, Mars Stealer, Socks5Systemz, Stealc, VidarBrowse
                                                                                                                                                                                            • 192.229.211.108
                                                                                                                                                                                            https://prezi.com/i/view/NEzvDMiy71AZ2uVfaGcJGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 192.229.210.163
                                                                                                                                                                                            EXTERNAL New Fax received from eFax - Wednesday 13 March 2024.msgGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                                            • 192.229.211.108
                                                                                                                                                                                            https://assets-usa.mkt.dynamics.com/eafd3d58-f4cb-ee11-9073-6045bd050506/digitalassets/standaloneforms/a5094c23-a3e0-ee11-904c-6045bd02a830Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.4.44
                                                                                                                                                                                            https://dl.silhcdn.com/1dc240dfb4eb6c5fGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 72.21.81.240
                                                                                                                                                                                            http://mebankingai.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 72.21.91.66
                                                                                                                                                                                            https://www.linkedin.com/redir/redirect?url=https%3A%2F%2Flookerstudio%2Egoogle%2Ecom%2Fs%2Fl3M3K3X4dgg&urlhash=Fl_p&trk=public_profile-settings_topcard-websiteGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 152.199.24.163
                                                                                                                                                                                            https://www.bing.com/search?q=%e8%8f%af%e7%a2%a9+TUF+GAMING+B760M-PLUS+WIFI%e4%b8%bb%e6%a9%9f%e6%9d%bf&cvid=8ed3431d674542bbaed6934068e7242d&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQABhAMgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBwgJEEUY_FXSAQgxMDUwajBqNKgCALACAA&PC=U531&FPIG=7973DC1DA237417B95A39D883F2961E8&first=121&FORM=PERE2Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 152.199.4.44
                                                                                                                                                                                            https://www.bing.com/search?q=%e8%8f%af%e7%a2%a9+TUF+GAMING+B760M-PLUS+WIFI%e4%b8%bb%e6%a9%9f%e6%9d%bf&cvid=8ed3431d674542bbaed6934068e7242d&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQABhAMgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBwgJEEUY_FXSAQgxMDUwajBqNKgCALACAA&PC=U531&FPIG=7973DC1DA237417B95A39D883F2961E8&first=121&FORM=PERE2Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 152.199.4.44
                                                                                                                                                                                            MICROSOFT-CORP-MSN-AS-BLOCKUShttps://ecv.microsoft.com/F5w9LBSgNJGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 13.107.246.40
                                                                                                                                                                                            SecuriteInfo.com.ELF.Mirai-AJJ.2909.8691.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                            • 20.125.16.226
                                                                                                                                                                                            SecuriteInfo.com.Trojan.Linux.Mirai.5666.25393.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                            • 21.30.177.134
                                                                                                                                                                                            SecuriteInfo.com.Trojan.Linux.Mirai.1634.8226.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                            • 20.136.244.165
                                                                                                                                                                                            file.exeGet hashmaliciousGlupteba, Mars Stealer, Stealc, VidarBrowse
                                                                                                                                                                                            • 52.168.117.173
                                                                                                                                                                                            https://wanlixing168.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 13.107.246.40
                                                                                                                                                                                            https://mtb-repo.pages.dev/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 52.238.253.184
                                                                                                                                                                                            SecuriteInfo.com.Trojan.PackedNET.2742.9443.15673.exeGet hashmaliciousGlupteba, Mars Stealer, Socks5Systemz, Stealc, VidarBrowse
                                                                                                                                                                                            • 20.189.173.22
                                                                                                                                                                                            Dp2pX5GLaH.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 13.107.213.40
                                                                                                                                                                                            https://lookerstudio.google.com/s/l3M3K3X4dggGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 52.96.87.210

                                                                                                                                                                                            JA3 Fingerprints

                                                                                                                                                                                            ⊘No context

                                                                                                                                                                                            Dropped Files

                                                                                                                                                                                            ⊘No context

                                                                                                                                                                                            Created / dropped Files

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandler.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):302912
                                                                                                                                                                                            Entropy (8bit):6.698956223631608
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:vwZfu+xXz86yji7+7tzuk3vbOtQtAO4D5eUdRx+Euqu7:GfuKXznyjiC75uk3CQtWD5Xx+ERu7
                                                                                                                                                                                            MD5:565DAF0070618C3BBB1D486B0D5A70FA
                                                                                                                                                                                            SHA1:3DF3AE144DB804EAF83BC0B89ED847380D476078
                                                                                                                                                                                            SHA-256:03E2EA9C1BE863F1BD007AE03C06BF3187751A00ED0CF7C4DEB3750951E5B960
                                                                                                                                                                                            SHA-512:DED5E2D3D3CA1198A576A0947127F584156919CAE2D67A688B90EBAF11C2AD8E2C50A494052245DB8A2423F90F037886A70AE2AE42EAF3122E1B1E53699FA176
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._[HC.:&..:&..:&..H%..:&..H#..:&.IO"..:&.IO%..:&.IO#.H:&..H"..:&..H'..:&..:'..;&..O/.@:&..O...:&..O$..:&.Rich.:&.........................PE..L......e.............................h............@..................................Q....@..........................................0...2...........N..@Q...p...$......T...................@.......h...@............................................text............................... ..`.rdata........... ..................@..@.data...t(..........................@....rsrc....2...0...4..................@..@.reloc...$...p...&...(..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandler64.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):397632
                                                                                                                                                                                            Entropy (8bit):6.440229620666291
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12288:/+n1e0P+GDRxRwwbClZ+jam+oAI5BciIx+U:/+n1e02axRJam+S5upxn
                                                                                                                                                                                            MD5:22DB9D0D4FEC050C0420274D3073994B
                                                                                                                                                                                            SHA1:46FAC4589B3FCEDA6076A36CC3D3E422C05FCCDE
                                                                                                                                                                                            SHA-256:00FF35AA88B2E1C9C271365A93B019CDD3A4ACA593642712B694628D45A12C8C
                                                                                                                                                                                            SHA-512:C22C6656073B7EC51390D900ED40C6AACB0BB19134BD210E17E1D7A2C27069A33CAABC7AF76D50DEE6BF73EBA982F31DB8AE0509CA5690D2E4A07E675C471D1C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9...9...9.......2.........k...+...k...3...k...l.......,.......&...9..........b.......8.......8...Rich9...........PE..d...O..e.........."..........(......X..........@............................. ............`.................................................H3...........2.......,......@Q......8.......T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data....6...P.......>..............@....pdata...,...........P..............@..@_RDATA...............~..............@..@.rsrc....2.......4..................@..@.reloc..8...........................@..B................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveCrashHandlerArm64.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) Aarch64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):372032
                                                                                                                                                                                            Entropy (8bit):6.290860581824482
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:KfMOKV6tGrZeRIigzy/zIdNyPKxtJiD6eJj3tXPPx0t1Nosmj1c5e7QTQx+4:atAZNzif5fsm25t8x+4
                                                                                                                                                                                            MD5:C8208EF35D885AF836E6740CB411BDB7
                                                                                                                                                                                            SHA1:82CD43B3E74C519AB6AB9E2495C0E217F61D246A
                                                                                                                                                                                            SHA-256:780FEDCD87E2AFC1A64EA295EA1A940EA69F74B43C625B6C85C0EECFD4142472
                                                                                                                                                                                            SHA-512:010DD5C202E313D53DCCF86964A86D5981723A28BFD64B78752FD135DEB90763A93E04A9373136DDDB19EB6109AA540EF4E30F826DF7C02EC735A65676673A88
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G.........X......X........................X......X.........N..A......A.B....A......Rich...........................PE..d...Z..e.........."..................R.........@..........................................`.................................................H........p...2...P..8....\..@Q..............T.......................(...@...8............................................text...D........................... ..`.rdata...(.......*..................@..@.data....4..........................@....pdata..8....P......................@..@.rsrc....2...p...4..................@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):175424
                                                                                                                                                                                            Entropy (8bit):6.036513000632513
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:cQPidj5By4/EeaZL8Z0BFri9WSfWJVVqH9B+bCe5kNtupnu0D6EDpf34fdjdEcRh:heaCSgfuqdB+i48
                                                                                                                                                                                            MD5:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            SHA1:184A42476F12A89731F608C7198E47BFC35A8364
                                                                                                                                                                                            SHA-256:633B554A26AD05C06DFE33A50F6D69E9160207F3168E15FFD3CB5652B1E8E9D4
                                                                                                                                                                                            SHA-512:DDB593D8A6BC515DCA7A4EADB2F50C28C8E61E9A829186BE9B9E8B19371E969FE055104DEFFD8CD5CD9B48F2468EC8B3D7BF6AEE45079E445D3FE42696E2D5A2
                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....A...A...Ao..@...Ao..@2..Ao..@...A..@...A..@...A..@...Ao..@...A...A...Av..@...Av..A...A...A...Av..@...ARich...A........PE..L...)..e.................<...(.......z.......P....@.................................A.....@.................................`q..x.......0............\..@Q...... ....^..T...................@_......X^..@............p..\............................text...4;.......<.................. ..`.data........P.......@..............@....idata..P....p.......J..............@..@.rsrc...0............T..............@..@.reloc.. ............J..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateBroker.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):116032
                                                                                                                                                                                            Entropy (8bit):6.62560704966013
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:oHsWPr3K6NL3FBqrx0LHu9eU53kB+XmkM/UTmG:usWG6l/q33kB+5M/BG
                                                                                                                                                                                            MD5:612BFE378FBE209AC8584AE27640A97A
                                                                                                                                                                                            SHA1:235AEA9A968A37CFCC8FD2C25C167EE3F8091607
                                                                                                                                                                                            SHA-256:CA510F6779F14699708EA640175D8CEF89388D07BE2435D22775FC078C483E0D
                                                                                                                                                                                            SHA-512:787A576E993E8D58F96EB2B0428B02AC318EABD249DCAFF26E87E6F01282CB407879D8BF280BC398D90D2EF822FDF4D11371BC732F12D8085C50DAF7F8D97407
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f.Hf.Hf.H...Il.H...I..H...Ir.H4..I@.H4..Iw.H4..It.H...Ic.Hf.H5.H...Ig.H..LHg.Hf.$Hg.H...Ig.HRichf.H........................PE..L...2..e..........................................@.................................M.....@.................................T8..<....`..x2...........t..@Q...........-..T...........................`-..@............................................text...s........................... ..`.rdata...^.......`..................@..@.data........@.......&..............@....rsrc...x2...`...4...0..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateComRegisterShell64.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):195392
                                                                                                                                                                                            Entropy (8bit):6.420855633369088
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:INA1+FyhLMnQtMIHh1a/r8/kGgTWZi1vnoY46u8sOMRzy+jGre:OAowhLMnQtMIB1a/ospTbohL5y+yK
                                                                                                                                                                                            MD5:F2CA542F38E6B51EDB9790369117F54A
                                                                                                                                                                                            SHA1:BC2E23A3FE66D39153CE5334F25FB218D9CE4FC0
                                                                                                                                                                                            SHA-256:ABDD09D0B7A2718FDA3FED25F0C404F228BABD83AA59148AA40BD0E4E9A937D1
                                                                                                                                                                                            SHA-512:07992FDB6B98940D403BE1AE6A7D49706EE198DF3A18771C330CB4703C4C9E83D519B23FE5CB4B1A117E7B70BBED7EB159F962AC1D7F942C8358F8DEA7F770BB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........d..t7..t7..t7}.w6..t7}.q6..t7..p6..t7..w6..t7..q6..t7d.}6..t7}.p6..t7}.u6..t7..u7=.t7d.q6..t7d..7..t7d.v6..t7Rich..t7........PE..d...9..e.........."......r...X.......P.........@............................. ...........`..................................................{..x...............@.......@Q...........^..T....................`..(...p^..8............................................text....q.......r.................. ..`.rdata...............v..............@..@.data...@2...........p..............@....pdata..@...........................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateComRegisterShellArm64.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) Aarch64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):154432
                                                                                                                                                                                            Entropy (8bit):6.173383322052518
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:VkKhe7NGODfqGfusU730roSnXvnaaDSNcp/:hhmNFDfXfusAxSDSNK
                                                                                                                                                                                            MD5:F0DBBAC441C6232C55D5275C77A77DD4
                                                                                                                                                                                            SHA1:6AA9207B5E119091948CF286A98138E1D9B0ACE8
                                                                                                                                                                                            SHA-256:1B9A4836FD73243ED7B472D71344CFE103760413334D0E5B947C87832332CC2A
                                                                                                                                                                                            SHA-512:9FA2CEDEC9AD950624B9782F6E47B322966605A6E412034471C0C8AE52CFBA894078F53671BB6F9B72C2D9584EA879A028EE37341A694443F1A517658B4DA4E7
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|.8.8pV.8pV.8pV...U.:pV...S..pV.j.R.+pV.j.U.2pV.j.S.kpV..._..pV...R.#pV...W.!pV.8pW..qV...S.9pV.....9pV...T.9pV.Rich8pV.........PE..d...^..e.........."......2...........i.........@.............................p............`.................................................H...x....P.......@..........@Q...`..T... ...T.......................(.......8............P...............................text....0.......2.................. ..`.rdata..v....P.......6..............@..@.data...80..........................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc..T....`......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateCore.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):224576
                                                                                                                                                                                            Entropy (8bit):6.731913745591885
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:XvFYwxiy+jCOCx2FssbcF8RLcul9+2+xwEJAg0FuRxqD2YqMR5+oZmYex+n1+P1/:XNYwBOPfbcF8qVtAOOTR5z5ex+sN
                                                                                                                                                                                            MD5:6E63E263EB7CB0A31F4800D274BD3936
                                                                                                                                                                                            SHA1:89F0AF0FB5DE7288DB94A6B4DEFB9BB474216989
                                                                                                                                                                                            SHA-256:9D8EBA8007E48AE1FFCC28129AB894814F844AB5C5D1543A3C8CF863C0F88A47
                                                                                                                                                                                            SHA-512:55C74E7F32E6CE21670BBA7003EBB00AC7A121A3A11B535F98D1AC3D35D1893449CA078FD093FFFCFD7547F99DB167ACAFB427F0057ABAA9115382BB0315998E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........bm...>...>...>^..?...>^..?*..>..?...>..?...>..?...>^..?...>^..?...>...>...>G..?...>G..>...>G..?...>Rich...>........................PE..L...T..e.....................`......v.............@..........................p............@.................................T............2..............@Q...P......@...T...............................@............................................text............................... ..`.rdata..............................@..@.data...l&..........................@....rsrc....2.......4..................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateOnDemand.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):116032
                                                                                                                                                                                            Entropy (8bit):6.626583684028364
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:yPMWPuHKCqLXFBqrG033M+tZnkB+XmaLNrfei:MMWtCYfqVnkB+PLNh
                                                                                                                                                                                            MD5:088EBFFD13539DBEF1204243C3558999
                                                                                                                                                                                            SHA1:4E2302B2008CD8CCA7DAECBB13D42931971890E2
                                                                                                                                                                                            SHA-256:79BAB0D36F4682194C20694F67F1B716438E7EAFBDBB83D9681259A41276D857
                                                                                                                                                                                            SHA-512:55A671BF0BAA2407D14872AA3ECAA485D2FC267AA57374A1E0871B5060372F8989FFF8444B65BF256A45D9B92568F9B69F759F8B1E5DACE94EE91FB0A7774F03
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f.Hf.Hf.H...Il.H...I..H...Ir.H4..I@.H4..Iw.H4..It.H...Ic.Hf.H5.H...Ig.H..LHg.Hf.$Hg.H...Ig.HRichf.H........................PE..L...4..e..........................................@.................................,k....@.................................\8..<....`..x2...........t..@Q...........-..T...........................`-..@............................................text...s........................... ..`.rdata...^.......`..................@..@.data........@.......&..............@....rsrc...x2...`...4...0..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateSetup.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1446992
                                                                                                                                                                                            Entropy (8bit):7.913845028849878
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24576:w2hOU0p4qlWfBTfmRfanIT6lUScOWFohEp6Vvn6qtndPVmatCkbpmp:zhOJpP4JTm5T6lkFohDB6sndPVa6g
                                                                                                                                                                                            MD5:E3E7498C2436A1570109FBE755AF1D40
                                                                                                                                                                                            SHA1:D7FB79F465D2C87EF22088327B5BFB73899FDF7E
                                                                                                                                                                                            SHA-256:498E27ED4E5BB584672992F459C0E51CD1E7345889DFF1521CCF577B13ED6313
                                                                                                                                                                                            SHA-512:4DD6025D4EBD1D4EDEEC077EE39E8704D2ED04FFD5F7AD83934A2ADA8D0E3AEFB15841B36AD0454E0C2CD6BE12E13B2015DE322D27059CB2FEA8BB7F4A247096
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........................Z.....................................................................~.............Rich....................PE..L...!..e.............................i............@..................................\....@..........................................P..<g..............Pt..............T...........................8...@............................................text... ........................... ..`.rdata..B...........................@..@.data...T....0......................@....rsrc...<g...P...h..."..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdateSetup.exe:Zone.Identifier

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                            Category:modified
                                                                                                                                                                                            Size (bytes):26
                                                                                                                                                                                            Entropy (8bit):3.95006375643621
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                            MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdate.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1116480
                                                                                                                                                                                            Entropy (8bit):6.768405587681001
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24576:JYCOm/qiJZz4j02iDtjNDhSRXaD5O5sHG4reqc8fvT2bz9cjclU:NO8Z0jniDtjNE6Y4rNvTkz9cjclU
                                                                                                                                                                                            MD5:36C7B693D057C28F237E57964DC3D785
                                                                                                                                                                                            SHA1:468394D765AC4EA8A92C4B673D4A10C6DAA1CDBE
                                                                                                                                                                                            SHA-256:A718ECF01E9E995A189A6A0F9F6367ECAFECEB7BDA16705E8B7037AB844E51C5
                                                                                                                                                                                            SHA-512:6F3220C27BF9D44BCBA0AB1457543D29E1DD8381541624B81045D868813D5EE647035B42761A9F53D25DBFB5D00F598254E1BAF51816052929E637ED793C8E45
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......r.Y.6.7.6.7.6.7...1.7.7...0.7.7...4.'.7...2...7....4.7.d.3.'.7.d.4.!.7.d.2.y.7...3.,.7...6...7.6.6.W.7...>...7...7.7.7....7.7.6.....7...5.7.7.Rich6.7.........PE..L......e...........!.....R..........}........p............................... ...........@.............................T...4...........................@Q.............T...............................@............p...............................text...qQ.......R.................. ..`.rdata..4....p.......V..............@..@.data....X...P...4...(..............@....rsrc................\..............@..@.reloc..............&..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_am.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):53568
                                                                                                                                                                                            Entropy (8bit):5.575420072105715
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:AR+H4k4+J2HNyb8E9VF6IYinAM+oP90at2rIYiF9qmPd9AM+o/8E9VF0NyKz7P:jHZJOEpYinAMxBYiLPzAMxkEkn
                                                                                                                                                                                            MD5:550A1B340AB88809669FD17EC434561A
                                                                                                                                                                                            SHA1:0F6C12C069746DB4AC01DA97185E090FF509C546
                                                                                                                                                                                            SHA-256:3C113F4FF22B63D42E4B3351EA2952DBB1842655DD52F0F84951961CA7C303E7
                                                                                                                                                                                            SHA-512:5AD6E4B96196B15FFCFBD189AEF474DDDDBE5E6AC3FBC49BE7EA9C99A39D8F8C38FDBF7C6D0FE20B1FF0048A2E8E0BB94631FE718C507301837B9347B3A3257E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...7..e...........!.........z............... .......................................H....@.............................D....0..(....@.. q..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... q...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ar.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):52544
                                                                                                                                                                                            Entropy (8bit):5.5725435735274305
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:J0ovtkCLu+JG8Nyb8E9VF6IYinAM+oP9VtdzACyIYiF99OAM+o/8E9VF0Nydh:PvtkCLdrEpYinAMxAEYi0AMxkE9
                                                                                                                                                                                            MD5:BBC6198B60210C1578CBAA60B96FDC70
                                                                                                                                                                                            SHA1:3A19EFD437D2C35CB15F2AB2D813466E8B1066B7
                                                                                                                                                                                            SHA-256:9196D431048A4481911054ACAD58D849D9AC38715A2F164FB09CC52F5E41D105
                                                                                                                                                                                            SHA-512:D89A7F66BF6273A0A232D543FDB98CF583B0DCDE2FFF058AA018A2368D0F0918CDCB317D0729749F490D5F6A5D9D36B04F73CB8E2CC3E3D69A123808B787B0A9
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...8..e...........!.........v............... ............................................@.............................D....0..(....@..xm...........|..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xm...@...n..................@..@.reloc..$............z..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_bg.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55616
                                                                                                                                                                                            Entropy (8bit):5.5655586584292065
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:Jq/odckbeGZBOcl8Nyb8E9VF6IYinAM+oP9ax7AIFEIYiF93jjMAM+o/8E9VF0Nm:yoV7DlcEpYinAMxyL1YirjMAMxkE0u
                                                                                                                                                                                            MD5:DA09EAA0D93375AFE0709C1809C14939
                                                                                                                                                                                            SHA1:9FD4700E02BFBB7E4C890CDD59F0620FB0F9FE17
                                                                                                                                                                                            SHA-256:0BD086FFED7296FF1FD8228AED8F80B8D9A8E2402AB974A9258A86887347E502
                                                                                                                                                                                            SHA-512:392C0DEE8ED74DC12978E29F5777BF5D3E93BB0F839C156951F34EAA9A72AC9F4E132A99344D9EACCD5D98AB12CC7EA5F95DC1D503B6C6CB1F4086380AAC3A96
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...8..e...........!......................... ............................................@.............................D....0..(....@..8y..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...8y...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_bn.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55616
                                                                                                                                                                                            Entropy (8bit):5.623684706857659
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:JcKhvUx7tYF7qKF0FrHF6zjbmBwgNyb8E9VF6IYinAM+oP9ndzZIYiF9wQAM+o/i:xhrlF0FrF3BwYEpYinAMxaYi1AMxkEI7
                                                                                                                                                                                            MD5:28C55146F4311953E1CF7E468C8DC74B
                                                                                                                                                                                            SHA1:76442CD814BE3FB21A0E2E8608E564C785548F13
                                                                                                                                                                                            SHA-256:32216C7119BE97564830F8CBF4888632E7D1AC5F99AB65DA6C2E6A28D511800E
                                                                                                                                                                                            SHA-512:5E13C7820218C29F26C64C12C318E40C11759B37300793F22E08F3D828361CCB1244123610B4AFE3E9E9E454263A862D136A96E4271B51378C50E8D2F8A83D47
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...8..e...........!......................... .......................................{....@.............................D....0..(....@...y..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ca.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55616
                                                                                                                                                                                            Entropy (8bit):5.39160458880719
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:Sv2ArBupGEEpYinAMxVYiDWdSAMxkESKM:Sf397HxV7DWGxuKM
                                                                                                                                                                                            MD5:44ADDEF5DF612EF84086876FFA323A76
                                                                                                                                                                                            SHA1:CC7639439B15CAF8FC8F9240BEF8B757BB3054A2
                                                                                                                                                                                            SHA-256:108525B759F60C5076BACA70474640E1E262BF77FF3F1A1E7822198416084D55
                                                                                                                                                                                            SHA-512:7211E8549A4D6A3BD6C425DA1065F8AE0DAEE1C7325D63A8E8535FAD7464A2043CCB5F379310AB4A22C4498728F3317B79F260C097CCC652817FB521D317106F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...9..e...........!......................... ............................................@.............................D....0..(....@...x..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_cs.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.442186434885563
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:OUBDBWpaJkhYwA+fwNyb8E9VF6IYinAM+oP9gpY83AIYiF97XAM+o/8E9VF0NyFx:huIEpYinAMxZsYiDAMxkEpb/
                                                                                                                                                                                            MD5:68BF6960F7C5BF7AE817EFFC7632C017
                                                                                                                                                                                            SHA1:F828B622D95F69222B68BBA9FA9F400672C84569
                                                                                                                                                                                            SHA-256:5314C94178A6861A88792F34D924A56B5CC7214CC4351AFCBED536D5C3F13417
                                                                                                                                                                                            SHA-512:71C84ED4417ED943EF752CDAC0D9E57FCAFAD80B3B16A2EE515734BF3A12F335FB9E4B0BE86DB1B607CF4E951D4306626C15C166C11579BBD0B866756D0DE53A
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...9..e...........!.........~............... ...........................................@.............................D....0..(....@..0u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_da.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.409036773195985
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:O7aUfNnwtpTqPqNyb8E9VF6IYinAM+oP9G5rJXEuIYiF9YabOAM+o/8E9VF0NymB:X8nw/+qEpYinAMxgUjYinaAMxkEm
                                                                                                                                                                                            MD5:6ECB0249DA48684622FE633F98F8F530
                                                                                                                                                                                            SHA1:1B9990DCCCD813FAC7C5517A03E5C147816E486F
                                                                                                                                                                                            SHA-256:0A52E3DC70183D8041683817CC0514004898E87D9C080FB93374E900660BBC0E
                                                                                                                                                                                            SHA-512:E48932205ED3362B4C915C572FCAAD012205837F54520F66C33B12F9AB4179E03AEB559C18465E3C419242CF039DA5C0271FD2CBC0031F1E7C7594C71CCB75BB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...9..e...........!.........~............... ...........................................@.............................D....0..(....@..xu..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xu...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_de.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56640
                                                                                                                                                                                            Entropy (8bit):5.377480288938011
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:XKjmxUM8QtPM0Me6INK/AGNyb8E9VF6IYinAM+oP96jjjIYiF99hJIAM+o/8E9VF:UmXjMePsAOEpYinAMxaMYivuAMxkEhJt
                                                                                                                                                                                            MD5:BAEA28AE8DD3E3C70DEBCDF1AE5448B4
                                                                                                                                                                                            SHA1:F8F40C17ACE4FBF272618063BC35F2502B00ADC6
                                                                                                                                                                                            SHA-256:4C2DA183A792B13077B398085CFF930CBF493B8CBEC50609F2BC6747F0B8092A
                                                                                                                                                                                            SHA-512:04DE4F7FA8C4A625724337539EFF093E2371ED417A6363833E7F65CBD14C9A0F64BB17EF1BA4BF51A16D6611E8240E4D2B248E4622BAB462DC331459DF64C851
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...:..e...........!......................... ............................................@.............................D....0..(....@...|..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_el.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.627688222986176
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:8Zr5lLO+R52/g4EpYinAMxSKYidzAMxkEd:2rl7207Hxt7dzxJ
                                                                                                                                                                                            MD5:5FBDD326F7F291BE11E1D79A7B2C8A51
                                                                                                                                                                                            SHA1:5701E5D3496F6D2F0C694D317F568A63990C311F
                                                                                                                                                                                            SHA-256:1CB97FF90568D81F8CC9E6A2EAFB07EAA276834169365980279403D99756103B
                                                                                                                                                                                            SHA-512:01BC099E7C875D6A0473F6FF577F14F3DA3123951596B5651BC757B6A2C10F293078452BB42A87084C3B862D4A0CD56129670234D2E9518E76379C534B534AAB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...:..e...........!......................... ............................................@.............................D....0..(....@...{..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....{...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_en-GB.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):53568
                                                                                                                                                                                            Entropy (8bit):5.419932966591344
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:Xy1/Nagyh6QuZNyb8E9VF6IYinAM+oP9p91J3ZIYiF9fAKAM+o/8E9VF0NyUNk:uNagyhi9EpYinAMxVGYiQKAMxkEYk
                                                                                                                                                                                            MD5:4396E672BC6FB86EDB0C6889D12CE082
                                                                                                                                                                                            SHA1:C92279D00DBC2DC0EA13E3A8896EDA76A359723D
                                                                                                                                                                                            SHA-256:F35E94567279C322EC1D4BB99EAA1327FCAA1F06F4BD9D1CEF8C897FD8BDA8C3
                                                                                                                                                                                            SHA-512:45F40EACE1C0398EBCA42EFF48DE6208BC87147837459AEE6D882CD017A9069CAD2EBEFE8B1EF0D27F36981DDD963416F0B7B5A26AF98A84B6CB64666638D0D3
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...:..e...........!.........z............... ............................................@.............................G....0..(....@...q..............@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....q...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_en.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.398655575356968
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:8VgzagyWk9RUNyb8E9VF6IYinAM+oP9BCDvCIYiF9L3qc2AM+o/8E9VF0NyQr:NzagyW4UEpYinAMxmYiOBAMxkE2
                                                                                                                                                                                            MD5:364F97EE7B79DEB51DCC8F5EC4A0EE7C
                                                                                                                                                                                            SHA1:EC4CACCAA57714FA8B9869315B6B13C530587E2D
                                                                                                                                                                                            SHA-256:DE1E4766E0A2C188604AB2927025E1F5B05CEBF7E7B20E8342B4206686A7EB96
                                                                                                                                                                                            SHA-512:43894949B412A8ECA8032F68DAC6C9208D9297B8C0353B9BBACEFE13343BB94343569F4CBEE1AC2B90971C8E2CC81408C55FC57DFEB94A6297D28CBB43E4D1E6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...;..e...........!.........|............... ............................................@.............................D....0..(....@...r..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_es-419.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.391103646647603
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:8Uil+fs4INyb8E9VF6IYinAM+oP94Y6uFkJIYiF9EW4EVdAM+o/8E9VF0NybJ9:Il+fs4gEpYinAMxnZYiWELAMxkED9
                                                                                                                                                                                            MD5:C2E2C6690755507979F570CA3E92E903
                                                                                                                                                                                            SHA1:F82052FC3D2C97C18CCAE91CB64C91F02DC09AC5
                                                                                                                                                                                            SHA-256:FD60F26D62F58D1AA41D11A8AD3086E2A0D92EF22AC766F606AEB2BCC3B217EB
                                                                                                                                                                                            SHA-512:319A6418576BE4274269F533A5CEF62F9020B606494F3C7A5B299957931B919A86507F7888EAB5C6BB952BC65DAF76AE89439E72778BF97F77B30B520E904148
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...;..e...........!......................... ............................................@.............................H....0..(....@...v..............@Q......$.......T...........................`...@............0...............................text...8........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_es.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56640
                                                                                                                                                                                            Entropy (8bit):5.365606356097874
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:86qBkNzf1FNyb8E9VF6IYinAM+oP9FVIrIlppcIYiF9kSx6AM+o/8E9VF0Nyueu:KBkNj1BEpYinAMxI2Yi1oAMxkEq
                                                                                                                                                                                            MD5:91C76FBA7736D06307708EE572CB9ED4
                                                                                                                                                                                            SHA1:64764FCB44F18104E7554D8091BD0C7EDAA9D1A9
                                                                                                                                                                                            SHA-256:D62078627149F4B5B90EE68B56C640CE120519F2F0438FC136AF225510CBD343
                                                                                                                                                                                            SHA-512:F789D42681BDCEE52CFD342F019A16396DAE0E3F8C929A1A004E1F9F960EC94BE72B40E8D22A0DFEDA1F743564568F457EA64A6C6E5074F323C4655964402097
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...;..e...........!......................... ............................................@.............................D....0..(....@...|..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_et.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.407227689072818
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:VYBW7bDFbDZETJ9TSQMNyb8E9VF6IYinAM+oP9I6UwqLYcIYiF9sx5q7AM+o/8Eg:Sm96nHMEpYinAMxTYiOYAMxkEg
                                                                                                                                                                                            MD5:9599F4AEE019804B418245C5A86881C7
                                                                                                                                                                                            SHA1:517D4DDD90361B89359BCCC174D9A6ECDA391426
                                                                                                                                                                                            SHA-256:3023BFEDCD84AC065A38C4C6C983CCFAA0B3D5C02A610C6CA2EA00FD5545DABB
                                                                                                                                                                                            SHA-512:613C6F11D11D84C1208B1CD7BDF030C3D2F5B90BC4D134C6E0584121B688AD14B01CE38C56501898962F5C859A8AF54248E86F510C20F3F7E0415163FFF95F14
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!.........|............... ............................................@.............................D....0..(....@..xr..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xr...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fa.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):53568
                                                                                                                                                                                            Entropy (8bit):5.562768970202109
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:VCYQOZMK9Y5fNyb8E9VF6IYinAM+oP9eLcfiPdwFIYiF9EbrJAM+o/8E9VF0NyXe:c1VBjEpYinAMxMcqPVYicxAMxkEg
                                                                                                                                                                                            MD5:A09A6C8DC7CEFC6CB126939947884678
                                                                                                                                                                                            SHA1:16F90FF84A3CD8C98304459007C7D05A98D05CC0
                                                                                                                                                                                            SHA-256:C5CFADFE624A0B92B45B121DC30D06D89150BDB03FD45B4FB7B4534BBC7EB40E
                                                                                                                                                                                            SHA-512:AF6F3BE99AEA54D26E933C98695644596D814E4E8B880E5CE081093A474FB8DF973853DE5220E498ADC84FF752CFD1CA4165771F04048CA9ED7CB6C179050798
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!.........z............... ......................................q.....@.............................D....0..(....@...p..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fi.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.408662294317196
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:V1HzPEzPhXY7RzYd99hKh1GAsNyb8E9VF6IYinAM+oP9BSzehCaIYiF9ca8lAM+c:PzPEVmKgsEpYinAMxqzTYin8lAMxkEsI
                                                                                                                                                                                            MD5:1DFC8B3110BA27F76C5C6495533AF538
                                                                                                                                                                                            SHA1:DD60677F7AED0FBC06877333136562EDAF0BAECA
                                                                                                                                                                                            SHA-256:60A159777971A84302E150866CAE1339ADC04939BF12B7B2367243361499BBF9
                                                                                                                                                                                            SHA-512:37674C26A179B839239337219EAF8F78AEAC10425DE5E7CC5A91B140B816410EEC5C4DE84E7BE825BA4CED3AA41F1B421B1902D26C5A9384C725C5682017ED72
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!.........~............... .......................................G....@.............................D....0..(....@...t..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fil.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55616
                                                                                                                                                                                            Entropy (8bit):5.386310916321289
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:D7U9w+B3RVawWrEpYinAMxmR7zYiyOAMxkE8e7:D6w+B3RVawf7HxMf7y8xN
                                                                                                                                                                                            MD5:20152624A1FF01D9F2BAC28D7B00CCA9
                                                                                                                                                                                            SHA1:A320967BEE24E07725E3AC2DC2F66F264F1B9221
                                                                                                                                                                                            SHA-256:80063F2CA78C9C757FB06B36F24F0347992DD75D300C4FB4A0DAA90D31B83A2D
                                                                                                                                                                                            SHA-512:A9334CC7D97A212F816EEAC0EBE8D6A5CC4B83C72DC10C34682AE504EA9690C077A84246DBA1462E991C609431CC93B085ADC14DAE28D468B537305161D56EF7
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!......................... ......................................-.....@.............................E....0..(....@...x..............@Q......$.......T...........................`...@............0...............................text...5........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_fr.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.3857985161200785
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:qqov98EoycpW4xUNyb8E9VF6IYinAM+oP9HaOp/IYiF91ihkAM+o/8E9VF0Ny3j+:OvaycNUEpYinAMxoMAYiAhkAMxkEt+
                                                                                                                                                                                            MD5:7704C15C3F3F312CAF2849DC2EAB0E78
                                                                                                                                                                                            SHA1:E3C673D407464CCB1E2DF5FC357D814C61213F7B
                                                                                                                                                                                            SHA-256:FE634E2F6C7AD7BAD17BD0A956B612BB14A9064B98CF5B5E013E08AC19204744
                                                                                                                                                                                            SHA-512:704A7541B55962E0DB1BF9388DA3F8A2AE1AE284AA60409D5FBC30F9BE275658D10C2DBFA80DED9F12632DA0F4F076925B5658B4F16EEEDD5320AFEADDEDCE85
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...=..e...........!......................... ............................................@.............................D....0..(....@...z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_gu.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.61051850410968
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:q6qm3UbeAV4DnYCRfwmkIPNyb8E9VF6IYinAM+oP9iCpiA4RpIQnBIYiF9jdiAM+:EUUbe7hbzEpYinAMx07nWYi0AMxkEoem
                                                                                                                                                                                            MD5:41B7CEF8A631E5F9FF1B54F6B0CE13E7
                                                                                                                                                                                            SHA1:8B695116808D99DE0B49EB54FF8AFA9A6E81368B
                                                                                                                                                                                            SHA-256:3B5FFC2C6DCE2BE431CF686FCD2D2CD39FF003D42AFC27887CB128B34CBEE354
                                                                                                                                                                                            SHA-512:15E72B1B3FDEB5A7AC2C4AB044224D25521A820AE62C725ECCAF6E3E2C1CDB24F9EAFB3AA12E1C1ADB042E762D49E0FE6A3B81280D1E5346BCDBDFFB8712B6FB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...=..e...........!......................... ......................................1.....@.............................D....0..(....@..hz..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...hz...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_hi.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.584260993420684
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:j4x6AN6AQqjexbyqKXhHqC1EpYinAMxlcYiXl2AMxkEb:j4xXc7Hxlc7VExH
                                                                                                                                                                                            MD5:5EAF10368F71EF58845D728B1C35DEDA
                                                                                                                                                                                            SHA1:1D525E25F5B1B2546285B0BCD18BE0D2F81F17A5
                                                                                                                                                                                            SHA-256:E9FBEA12B32D02160D14370501A622C032114C592EF7C5BF94EB620283FCB6D7
                                                                                                                                                                                            SHA-512:94B31603651BC5A3BB51E44E07AF1BBDB4B6D9EAF5B0AE7584525155224F23F653AFEA2DDA885620C6362D8CEE6189C5B6C86C2D76E2CDB541415A604A4B1FE3
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...=..e...........!.........~............... ......................................#P....@.............................D....0..(....@...t..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_hr.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.402610840778619
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:TsfBpdOXz19szMH5KBL/yNyb8E9VF6IYinAM+oP9I2ZlxEIYiF9GTJAM+o/8E9Vz:GBK5oL/SEpYinAMxPYiSJAMxkEn
                                                                                                                                                                                            MD5:615FEEC50393BF657E7B84A864D534A7
                                                                                                                                                                                            SHA1:0D3807C4E28D0121C43B3A910BD4538DEEC70B5E
                                                                                                                                                                                            SHA-256:6EB847167FF384D1D30B6D16939980DC89D95547A18CBA91136CE66CEF6C06B7
                                                                                                                                                                                            SHA-512:76FEF42FD098DAEAC39B495C5AF7E71784204936D4D75483BB49678C3995C7FE0FC3B75F5D2E034FB974AFCFE45FA4158801C92F0A55441C5E8CD34647142AFA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...>..e...........!......................... ......................................T.....@.............................D....0..(....@..@v..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_hu.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.425116799449756
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:Q17U791C2TzpwGFTbZY6d1lBVZ5qAy3FGd7HxQ74xXa:Q17U791C2TzpwGFTbZpd1lBVZMAy3FG2
                                                                                                                                                                                            MD5:E200F70987E56CBDFF8C6A587A02705F
                                                                                                                                                                                            SHA1:8C135AD82792C337445DAB4677B654C7390BF36F
                                                                                                                                                                                            SHA-256:B285107D2D2F2D64F2F060CF57E29B08C5DD9498CE8CEF83ED7C30032CE4625F
                                                                                                                                                                                            SHA-512:81163C216A1D4FB7B328D4982F4A251601242320EB413B88F423CB133526484667328716D368DAC110E6E2E4715814A8A1A85BF56A81C42DC8E48049DECDC767
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...>..e...........!......................... ......................................_.....@.............................D....0..(....@...v..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_id.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.402370571282084
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:TxFmhL3THRNkAHqQ3lFRf2I9ByrUvNyb8E9VF6IYinAM+oP9Lfu7byIkdIYiF9X0:WXhR5TEpYinAMx8oKYitAMxkEc5
                                                                                                                                                                                            MD5:16C771FF09E9BCFE7FD617C0F5D489AA
                                                                                                                                                                                            SHA1:55AC69B62DD357DE4884A95F95786AF979F2CFE2
                                                                                                                                                                                            SHA-256:6F747BB6BCF0491A3B7F2F04B802C41BD895A01D94F11E7E5B6721B17DEE26F7
                                                                                                                                                                                            SHA-512:D85B041F62241EC6F4685372895200FECCC1F277F1E0D4A5015AD79CEA12FD19BB4B864EF871A4F6D7B4C0D887F4F92FAB74BFDFA7940B07866B063464749C4F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...>..e...........!.........|............... ......................................z2....@.............................D....0..(....@..Xr..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xr...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_is.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.42997837750232
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:gJqibAIErkUVQF5UefV3BEpYinAMxxYiPAMxkEA:gJqibAIErkUVurfVa7Hxx7Px0
                                                                                                                                                                                            MD5:1844776B1E873892CB6D453EBCA334A2
                                                                                                                                                                                            SHA1:6F36F4BF2CE6D286C0E1E59041EE506BBB96ED7D
                                                                                                                                                                                            SHA-256:98E823748DC2E72B8B5A46827D501E12C9C48E209643F2DD6B4B8D333501DF8E
                                                                                                                                                                                            SHA-512:8C48EB7CC40EF6798C9789A9B860BCF508D3740E948FE64E1197A422CFD240A6430FC36B5AFC23A5C1CA73FB155003B22A57AECEB207741BC9EBCAA947A411B6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...?..e...........!.........|............... ............................................@.............................D....0..(....@...s..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_it.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.3695383590059125
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:4SIlDIN+shh3+Nyb8E9VF6IYinAM+oP9BNgIYiF9zMAM+o/8E9VF0NytlR:UVIN+q3GEpYinAMxPYiIAMxkEP
                                                                                                                                                                                            MD5:E7A5254E3C732ED21F756B90EE6C73B3
                                                                                                                                                                                            SHA1:EE2C5D342E51BE27750F5C855A9437B6BF3FEB86
                                                                                                                                                                                            SHA-256:9342ACA1761B4F81F8771F19CB4A1ABD77F392194D32758FF42B98F8AA3D6CB5
                                                                                                                                                                                            SHA-512:75F83A5905F8254E4FB352D00B8173D2A5614C17D166C06AB87C0B67C1C7BDF99377C7BBB89A85E6AFC5F0E5F8A045E45D64B2B157A413E871C015EB65D46F3A
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...?..e...........!......................... .......................................a....@.............................D....0..(....@..@z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_iw.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):52032
                                                                                                                                                                                            Entropy (8bit):5.602368818487498
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:4cKIv7hdVexaDywGfJssDNyb8E9VF6IYinAM+oP928tt+fIYiF954AM+o/8E9VFt:EgNM1fEpYinAMxZRYieAMxkED
                                                                                                                                                                                            MD5:0DC19E59ACEDB7D103D0C21B02804661
                                                                                                                                                                                            SHA1:477FEAD06B9DDFB85185DA85A640E6BB467FC32A
                                                                                                                                                                                            SHA-256:17ED8A04CC1BCAB734F23140BFC8145BD0D038C284D50F439DAD1E66F7647C22
                                                                                                                                                                                            SHA-512:20F3E9B58E9D5AE3F08096ABD5D5A43DB93238FDCDF2E96126A4B4AEB06BE2C8ADDDDC6601136EA265770AFCC7F4BE41E20F1D28CA361FE0135FC98BFA71F392
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...?..e...........!.........t............... ......................................nn....@.............................D....0..(....@..@k...........z..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@k...@...l..................@..@.reloc..$............x..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ja.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):51008
                                                                                                                                                                                            Entropy (8bit):5.615534777551888
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:hz7iEHj0FgWGNyb8E9VF6IYinAM+oP9EimJIYiF9mRDxAM+o/8E9VF0NyzCU7rR:RiED0FgWOEpYinAMxHYiWDxAMxkElt
                                                                                                                                                                                            MD5:6C6093A914A889BC15133A57DB09C395
                                                                                                                                                                                            SHA1:A8F9D54288D636E586271D78E7CF69E9E0121E16
                                                                                                                                                                                            SHA-256:EC7AF1E9B03241F85A99F9C807FE279E322CA5528DD08B33F65D0CEFB8F04EED
                                                                                                                                                                                            SHA-512:3548503A8395ABD3D19D3FFEF24832242F6F6C742678C0657FBF795DD14584B9F35BE5B02D7BC6657D486E63609E0687C1E277857DBEFCE6AE7D97E6E135605F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!.........p............... ............................................@.............................D....0..(....@..@f...........v..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@f...@...h..................@..@.reloc..$............t..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_kn.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.638575498464374
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:hgLfUIRBSWNyb8E9VF6IYinAM+oP9BGv0Xs8fIYiF9ngp+AM+o/8E9VF0NyNwZ:cfU8k+EpYinAMxq8TgYiop+AMxkEo
                                                                                                                                                                                            MD5:12B9BE5F0923BB2313C68BB46A069F4F
                                                                                                                                                                                            SHA1:150A975918C1435027F295A06058C5BC110B4AB0
                                                                                                                                                                                            SHA-256:DCBA408E4AFDC0831CB26D08EC05EA0616F14071E81ABAC8FE5676636C2EE151
                                                                                                                                                                                            SHA-512:1CFC30E83851456DD3A5925925E34AC12F7148E20F487CDB82E0F01E06DD77B6411CF03B2094C11DF9566B1228A97024065A78F77100493902BBBEFDF6502D27
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!......................... ......................................n.....@.............................D....0..(....@...{..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....{...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ko.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):50496
                                                                                                                                                                                            Entropy (8bit):5.652443774196828
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:hUELKTd4IY+N1vZsYoRHgA12plxB4xRkkTY1M5tkOANyb8E9VF6IYinAM+oP9cbA:HLKWmAf/jv4EpYinAMxhOHYiSAMxkEp
                                                                                                                                                                                            MD5:10BAD5A24446C6E00AD2C18D09B000E0
                                                                                                                                                                                            SHA1:FA030AA1F64894829C0CD8211488B38A18D12297
                                                                                                                                                                                            SHA-256:91649E91509AA7200BB669AD2F5F6788EBAD7C5AA2CA6D7BB855E9FD96D010AE
                                                                                                                                                                                            SHA-512:6AA1E426BF7AA470058810F0515A94C1F6D624B4FF3D99BBA09C850FD17DA4A2C2C50BDEF44AA28BBB3358486844520C46482FD7295B9EE50CCC8449940016F6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!.........n............... ......................................P3....@.............................D....0..(....@...d...........t..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....d...@...f..................@..@.reloc..$............r..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_lt.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.426785047163885
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:X1ckHz05TmDq09ZEpYinAMx7b+YivPAMxkEkt:X1ckHz05+i7HxG7Hxwt
                                                                                                                                                                                            MD5:74838014C6FDA1D53C8EDC8679F9D28D
                                                                                                                                                                                            SHA1:491C640873E70CD0C703C57DB6F0FDC941CBE7F6
                                                                                                                                                                                            SHA-256:6AAC9D75D6D02884C5CB5EF33A4BD1801D9BE70DD937C624F21E492F64CADF68
                                                                                                                                                                                            SHA-512:ED792A4B625D889D8D17AD1DD23D0CC015F28B3DBCA5CD6C525E8C814996B1F806855AC4B9D59758306BE5F6F0C09979D1ACD64332E24F4C3358C5FD6857A22B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!.........|............... ............................................@.............................D....0..(....@...r..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_lv.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.43355377301059
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:GQQpZyAxOeK6eDNyb8E9VF6IYinAM+oP9l4ZCIYiF941WAM+o/8E9VF0NylkC:IdufEpYinAMxWYiSWAMxkE0C
                                                                                                                                                                                            MD5:8FA152CA88C3108EFE077F57482BB42A
                                                                                                                                                                                            SHA1:B27058398730B18E39D9E16FBFBC5625AF403FF8
                                                                                                                                                                                            SHA-256:01C42EB00F2E6566D3FFF4AFB0B2C2FAF34C14A1A61E29DB86B3CB76D4EFBFDC
                                                                                                                                                                                            SHA-512:81620FD3D80A1C245BCBD643D1B579E3D413B3A0011AC65F39CE31929908FCD95C1D4C0D5BA89A1F907E02E351CE5EE2CE79B61E7176CA9706908BCE7A4BF59F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...A..e...........!......................... ......................................n.....@.............................D....0..(....@...w..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ml.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):57664
                                                                                                                                                                                            Entropy (8bit):5.590444403006137
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:G3zU3B7FZygp8/JLONyb8E9VF6IYinAM+oP9OFIj5iIYiF9ImPAM+o/8E9VF0Nyv:JRWJL2EpYinAMxpYifPAMxkEeC
                                                                                                                                                                                            MD5:F693B959CF8C7341020D18ED345AD74B
                                                                                                                                                                                            SHA1:FD57E1806796F23C639531E6DCC165FCEF4F37BA
                                                                                                                                                                                            SHA-256:0B37B36D43D032BFB68F06173107AB58E8C17904C3D1247C32690E168FA922F2
                                                                                                                                                                                            SHA-512:E474312498C874EF53A1FCC75A9D28A35341577BDBF672FB3D82D76A2BD9BFF6BE9477A61C64D1EB434FCB9FAC7B65912E033FDEF8877A681C614A035C01E347
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...A..e...........!......................... ......................................c<....@.............................D....0..(....@..x...............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...x....@......................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_mr.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55616
                                                                                                                                                                                            Entropy (8bit):5.588716592426551
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:GfvCdo/7JK7bABkCNyb8E9VF6IYinAM+oP9644k0VwIYiF9QqoAM+o/8E9VF0NyZ:uYo/7JK7b5CEpYinAMxmvYivoAMxkEBV
                                                                                                                                                                                            MD5:0DC5183697F790CF937860F9F8CCF8BE
                                                                                                                                                                                            SHA1:531C04F6AA3B363A14740CC33D1E4D98BF857BC7
                                                                                                                                                                                            SHA-256:8176DA09CFF7F0BAE0AA08430CC4CA093A68627FB631A377DF0EC82959E7F634
                                                                                                                                                                                            SHA-512:E58A71558240BEE892FB783E061BF481CC2F56F01BFA5F7A2C50C0EC69B2360AB9564E80C3D34ADE0296DB1D9509861484A3D6AB3936880AF9D23CE13FF1A373
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...A..e...........!......................... ............................................@.............................D....0..(....@...y..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ms.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.4114238474999805
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:Pr10IePeyrQLtUv6oNpaMkYjZZ/fbMgTRlREDNyb8E9VF6IYinAM+oP9LeFFjUIX:qjTZf3TFGEpYinAMx+jlYiFAMxkEj
                                                                                                                                                                                            MD5:742CD3150B436B909E5AD9AB6F22783C
                                                                                                                                                                                            SHA1:474B8B3B75CFB25C90EB33E8E4BBCCB07068DC8D
                                                                                                                                                                                            SHA-256:E537F7AB167D50E347B359AB848C46405C7FFD067408E896858C31AA99E6B228
                                                                                                                                                                                            SHA-512:CDD492F93BBE49F17DC8DBAA19C1FE1FB1B3403054703D20402B07A42BB5D5F5D20F1D126103AF0DCE62EA36299835902E7FAFF96EA5D7EACD59974E6F88A2F2
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...B..e...........!.........|............... ......................................?_....@.............................D....0..(....@..Ps..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Ps...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_nl.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55616
                                                                                                                                                                                            Entropy (8bit):5.380500350214481
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:P/kLXd/T3kXNyb8E9VF6IYinAM+oP9e8Kk6U92ZHIYiF9524AM+o/8E9VF0NyZwS:ULtgbEpYinAMxPSUTYiFAMxkE0S
                                                                                                                                                                                            MD5:A54633E30C2FFD23C3578C885E0E9F5F
                                                                                                                                                                                            SHA1:662988663B27C21A0CC310D304346466EADD76A8
                                                                                                                                                                                            SHA-256:3FB8523B91B2BFEE51CA2EA972ADA260F27BA389EA9E1DD7CB8411F21F126CA2
                                                                                                                                                                                            SHA-512:AF9213815F634BC3A1DAFDF0D2BE537E4634D690C118090A81DB1138130504B4EFD27D9D0599F7295B06A5BCCE44B71E200574E583C820E820CA84D72D6E492B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...B..e...........!......................... ......................................D.....@.............................D....0..(....@..hx..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...hx...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_no.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.41113033461094
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:PZ75JZSiyCSiykeRAYiTvaK3Q3Nyb8E9VF6IYinAM+oP9P+6kIYiF9+60/AM+o/d:xeCYGiK3Q7EpYinAMxtYiWlAMxkEh
                                                                                                                                                                                            MD5:A78998736B54EC264AD3FA9529693C8F
                                                                                                                                                                                            SHA1:4B468CCCB8AC25C9E9C05161DD5C44E08504B41A
                                                                                                                                                                                            SHA-256:EB3F06A4EA447CE64971673C50CCF83E2842303F1A27655F3A170495C94B71C6
                                                                                                                                                                                            SHA-512:F747EC1B69B931D90EF4CF31A5F8E7BA95B6AEC7B36299A0E988B1D4790F42BE8AF698FE66032324C9634E5A44FD251D7BCBFEF9C5529E7D2368FFA38CEB5962
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...B..e...........!.........~............... ............................................@.............................D....0..(....@..(u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...(u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_pl.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.433825393956769
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:Uym9mn7KZHCCA7U8Gp6hNyb8E9VF6IYinAM+oP9LK5SIYiF9YjAM+o/8E9VF0Nyi:SUy3AIylEpYinAMx0YiCAMxkEU
                                                                                                                                                                                            MD5:E73CF3871B41E0C59440C8D709CCFD75
                                                                                                                                                                                            SHA1:8428813368197AEE8E3C2BF2104297476BC4608F
                                                                                                                                                                                            SHA-256:AD124B0646894F3BFCB61D366D7BA5EDF4978766807B5422AD1778509231679F
                                                                                                                                                                                            SHA-512:A31E82503BB3D8E1DB9EF4C1030ECD481396183CC64905FAF91E52F9C3E68469FDF3A850357AD70466D2810855D2B58E19B9302499D2547F85A610B1F8159FF5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...C..e...........!......................... ............................................@.............................D....0..(....@...w..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_pt-BR.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.4115414787256
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:UYnLplZcOZX8mNyb8E9VF6IYinAM+oP9m675zIYiF9cHymAM+o/8E9VF0NycBM8s:3bguEpYinAMxJiYiEAMxkEI7s
                                                                                                                                                                                            MD5:0227D71A996FAB2B394DFB17A43F1F8D
                                                                                                                                                                                            SHA1:DA6002C093911114035CBD5D7D29FA51E3DF2C45
                                                                                                                                                                                            SHA-256:290A463B8B11E5F5C5D3BCC2B5B8D910721BA645E2B4B3AF951223F76610BEDF
                                                                                                                                                                                            SHA-512:FB95F13C4AC6A7B8AD13F271EE3D93ABBD5E0713F0C0DE402D7B73EC82B483A26C6B071ED5521914E34E74AEF168F9FA0762801FB37EAD9D05CD3D675AE2CCFE
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...C..e...........!.........~............... ......................................W.....@.............................G....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_pt-PT.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.392362813870133
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:UaAtOstnEx6ewB/Nyb8E9VF6IYinAM+oP9/KlAIYiF9J3ReAM+o/8E9VF0Ny1SX7:w/Ex/UDEpYinAMxGYiNgAMxkEC7
                                                                                                                                                                                            MD5:962BFFC6EC3DA987471851A4240AEB61
                                                                                                                                                                                            SHA1:BA1B8AFF4FACD861553039A256A7623ABF30CD66
                                                                                                                                                                                            SHA-256:3BD318A0867F1C971DAAE6A96C6EF2A09FBFB15EC5B3706DA34453410EA1F4FA
                                                                                                                                                                                            SHA-512:D975EE07C82CD658E4A3B6CF67BBD8FD41D989D718E5EAD479E0250BC3C66A933FD0E8B1DA468E0C906986AEE58E3C0F148E4F8A23B19121844F5847E1AE14D8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...C..e...........!......................... ......................................K^....@.............................G....0..(....@...v..............@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ro.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.412695960496245
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:5nCRNNDM7qm0GdVqT541naEpEEpYinAMxmYiTAMxkE0:5VdVqlca67Hxm7Txo
                                                                                                                                                                                            MD5:54B9FDA6AB88DC9EF0F0C8B19EA06CD0
                                                                                                                                                                                            SHA1:C34D52741A8986FCF0991A4CECFE1B2A7C6E85AB
                                                                                                                                                                                            SHA-256:1F00F564F1136096FBE58EFDB22E54923E090BA3392CDC51C837A7294A3FD5BE
                                                                                                                                                                                            SHA-512:BEFDF3BAED01EA905751CCE248E854CDC43D5A9D77B2EBD27E68C297464A5A0AC1ADF739E8371F0C731A5A7ABB83E6FA227D11120F70D668113F69612D44B6E9
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!......................... ............................................@.............................D....0..(....@...w..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ru.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.578353591774595
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:tlWSFA47AvHlho4d2hNyb8E9VF6IYinAM+oP9Hn737IYiF9iFAM+o/8E9VF0NyfL:qvvHUlEpYinAMxF0YisAMxkE+No
                                                                                                                                                                                            MD5:DD650BDAB776FD3239AAD311BC8CBBD3
                                                                                                                                                                                            SHA1:583A340581B2A78DF490951FFE6A7BEEBB51BA11
                                                                                                                                                                                            SHA-256:475B114201EC72F4EF26FC66B61AF438CE77F69E5E96D3CFC8FB00BA148AAC51
                                                                                                                                                                                            SHA-512:862313704DFFAD1AF1FA72D8F9F1FE4757A9A1082BE41C78E5C307C56F36D986D1F5580922800050E08BB37ED2EB18A6FF629131199E41350A22EA230DD6DC9F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!.........|............... ............................................@.............................D....0..(....@...s..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sk.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.437717171626643
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:t4lmP8uhJPiR6gLTmNyb8E9VF6IYinAM+oP9AWB5BGJgVIYiF90xFNAM+o/8E9V2:uMF8RjuEpYinAMxlgqiYicFNAMxkEAR
                                                                                                                                                                                            MD5:DC24DAA70A6551CD038929F3EC055306
                                                                                                                                                                                            SHA1:99843D43C0CC3D4C76A5C817CA4DB49820820C65
                                                                                                                                                                                            SHA-256:847440B8D60A11DCE3E254916E5CD926D58C9F06F0D95436B62FF9B9AAAEF4B0
                                                                                                                                                                                            SHA-512:451C21F435A451CC4C47623D028B1CF3939CB59B9F9A6D6D71B2F94F9B4CFD487A8756ACFF27768B454F23F2D501E9AFC67E586F9C005142CBC712E5CEDC2D9C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!.........~............... ............................................@.............................D....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sl.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.399846673022657
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:tkcnTcshVyigOHHTpWBdH1i2IXousrNyb8E9VF6IYinAM+oP9z5XKiS9IYiF9JJd:v+hOHHy1YZsnEpYinAMxfXvYinAMxkEP
                                                                                                                                                                                            MD5:FA0AFF0B7EFD37A6195AA454012095E8
                                                                                                                                                                                            SHA1:EF4A3CA1608A8FD5DE56B2B94DBD46304480B375
                                                                                                                                                                                            SHA-256:7580B1B666C4A6DE0EB5AD03DAFB2F9FB49AD148754A68611E9988ACBBA5023D
                                                                                                                                                                                            SHA-512:FB5A73B6134F991FC2E5D9A82B747C821074BEF86A7651638FC0127BEEF78B817811BB00417168BB937F968D55D8356AC0D19C2B569A6B9B31A10531683466CF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!......................... .......................................v....@.............................D....0..(....@..0v..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sr.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.573738261423414
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:CT63FOxCx7UjYN3tGGNyb8E9VF6IYinAM+oP93kDWvSpIYiF94yIj/AM+o/8E9V1:D3TUj+dGOEpYinAMxoCYi8/AMxkEq34
                                                                                                                                                                                            MD5:D5D54965E6FB81875F2FCEA8F21515BA
                                                                                                                                                                                            SHA1:87F22E6FA6D34CAA26CAF427D5F339880496EFE1
                                                                                                                                                                                            SHA-256:759CC7CC96EA181926AF2F6B274CDB9BF63E329FC32A7A1C10B4CFDEE786F2A6
                                                                                                                                                                                            SHA-512:308068EB57F007A4674BF5D90C9410BACC715E4AE537ADEC4CAF7F6837544D5526C676BEB2B1488090E7D9F4E966F030709C2934DE3A64E0A9059CE49D1F6A14
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...E..e...........!.........~............... .......................................x....@.............................D....0..(....@..Xu..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xu...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sv.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.415346681858155
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:CeC7xC7Ec3EINyb8E9VF6IYinAM+oP9Up1XIYiF9+kAAM+o/8E9VF0Nyu7:E7xCYc3EgEpYinAMxqOYioAMxkEG
                                                                                                                                                                                            MD5:9C09AE8A870215FF9CF80F09D44F5610
                                                                                                                                                                                            SHA1:2EE0328D7617A3D5A46C432DB2AE8BA2D335CB10
                                                                                                                                                                                            SHA-256:49FDD7A5FA81697613F0495EA9E6025FFF84565184A1F3279CA42B166920F1E8
                                                                                                                                                                                            SHA-512:7351B3955F0F881329DCD209841C84A05E0A2C2472FBF1B9F70505D4CE4A6A5FD612D45F3E11E917AB4D086E3B0C1CC7429238EC6DB6DBC879ECD9F3B8340B1F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...E..e...........!.........~............... ...........................................@.............................D....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_sw.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.425300372554538
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:CL9FgicgiY7upr4M5aNyb8E9VF6IYinAM+oP91k+DrpIYiF96sAM+o/8E9VF0NyU:QFQ07Gr4M56EpYinAMxwYiJAMxkEUh
                                                                                                                                                                                            MD5:1048D12C5DAA3492E2CC9060BC6AD9C4
                                                                                                                                                                                            SHA1:50051ED23E19D842EB6C9162F537E7C20185ADE3
                                                                                                                                                                                            SHA-256:9123A236243EC5508DB14A4E4E5B2BF3DCA077A6F6A85D24730D0A60A7B10518
                                                                                                                                                                                            SHA-512:F9F6FF586A13CB32281234478A9F7CE2C6222EB94029EBC448815A5083E0303FC7CCA26F03E38575D449E81869817425F9AB2FF321D6A7EA5EE2EB0F99FB6C7F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...E..e...........!......................... ......................................<V....@.............................D....0..(....@...z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ta.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56640
                                                                                                                                                                                            Entropy (8bit):5.625808123733913
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:KmHY51ZLm+4HwpEpYinAMxRBYinyxAMxkEqw:K27Hxb7+xmw
                                                                                                                                                                                            MD5:795ACCE152FDF555FC5F0CBDC21BAC4A
                                                                                                                                                                                            SHA1:B3A5F664D53813E69E33B4AEC327D8121E6066D9
                                                                                                                                                                                            SHA-256:F22F4C4B011B9989D73F0EF16D85F9AA5471CC03394C99FC6D74C401ECA88700
                                                                                                                                                                                            SHA-512:92638A7BD5962C44F3B21864FFBA114EF82B66334735D247B53ECC3A980C1208F597260547A2B9DA938C6D9D9BEF37AE94D5F6AF0683E0D551E6285D7FAE5769
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...F..e...........!......................... ............................................@.............................D....0..(....@...}..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....}...@...~..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_te.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.591538654163846
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:aVo3N5ya+LDQEpYinAMx7i+HCYi0GzCAMxkEX:aVo3Ip7HxI70LxD
                                                                                                                                                                                            MD5:CB8793AEC04A19877FA3702EDA7C9416
                                                                                                                                                                                            SHA1:7771A48AFE1B50C03BAE7D98090929753177C9DE
                                                                                                                                                                                            SHA-256:FA58B434E5253B28091CE425EC9296E499241CFC24992E1592154FD1EC449819
                                                                                                                                                                                            SHA-512:577EE217E15379E1523FA72FD995E450FE7DAD262E299B594CDC6A8455DCD5002454B84695BCB3B3370DFB03C0B540B931FFF2C43AC50311FB5E95CD9A76219F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...F..e...........!......................... ............................................@.............................D....0..(....@...z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_th.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):53568
                                                                                                                                                                                            Entropy (8bit):5.6119616279583715
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:TjlrGszNMfetNgEpYinAMxwKYi6AMxkEyI:TjlrGs+fetn7Hx774xWI
                                                                                                                                                                                            MD5:36FF03BB1A029CF62E2FBC0112AB1E1C
                                                                                                                                                                                            SHA1:C6BF4C0E47941019999722F1E57346498AF0A79A
                                                                                                                                                                                            SHA-256:0F6B55613060D527AE41D5BCF5F34F50BD668BA57F9D4D2521EE7DAB2D053C02
                                                                                                                                                                                            SHA-512:08AF745E330ABD384BF06468A2C1A7F6221B0A6C1A9452031FCB4076959C51EB912269EFF77E71F55BFB41C2BE1967A9373B224522ADF856E07B48593E68A92E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...F..e...........!.........z............... ............................................@.............................D....0..(....@...p..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_tr.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.448739449189127
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:Jip9ABk6qXQEdmvgh3FGk+G9Ahrx++BzQSX/EpYinAMxlDCYiZ+mAMxkEPo:JiZhdmvMFGkSxLQK47Hxg7Zxx0
                                                                                                                                                                                            MD5:96C569C1FF875B897A2EBDDD3BCEE40B
                                                                                                                                                                                            SHA1:44F8019C435ECBC1B00E8F1223ECE6C42F1E9976
                                                                                                                                                                                            SHA-256:9682AF6D55EB930C650D69D7ECD4A6101681425F4821333C4513916AE57CC14D
                                                                                                                                                                                            SHA-512:4E6521B28184AB8D09D45FD30E96F3703ADE7F495211380DB0BA79F0372CD834861165B9D66D8CDD0A036850C9866203A6EE60642B80DB4F89D7037BA56C8BC2
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...G..e...........!.........~............... ......................................$.....@.............................D....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_uk.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.574026643245629
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:QxZMuKgHWyC2EeovVHE/GfuQNyb8E9VF6IYinAM+oP9+Z9BIYiF90+1AM+o/8E92:UMu2uoEpYinAMxkWYixAMxkEw
                                                                                                                                                                                            MD5:BB5F78643FDFBB3600ABB2D4529D857B
                                                                                                                                                                                            SHA1:95F987F0237584B8428470EF8A34774CB18E83DE
                                                                                                                                                                                            SHA-256:2D701243EFCC415F101A68D9A80BD1F93718DF906C5A9DF94B7C7210A72EEFA4
                                                                                                                                                                                            SHA-512:98A80DC74B3A7FAA06401299E2260D6E5801F30C0066F6F4F3BE0B66D432E36FB72044038B839019B0EC37FB8B7317046DD69E74F2E97A7C3CA1DB277891345F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...G..e...........!.........~............... ......................................@.....@.............................D....0..(....@.. t..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... t...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_ur.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.583323336112305
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:avoo+OmAcoWACeesYQEpYinAMxYn/YiGAMxkEj:am7HxG70x3
                                                                                                                                                                                            MD5:0E98103A45EBECEDAE05F0EB6BB4AE6B
                                                                                                                                                                                            SHA1:4FD5E0061553B702FC058A1052B6A0CE58F470D7
                                                                                                                                                                                            SHA-256:B5931F32C31EFFB7FC90F95CD27481DB36B6BDB31FBB982CA787794D7E51F892
                                                                                                                                                                                            SHA-512:DC37D909B89017BB2395D8C809D65427AE8C485075FD4D725D3A9BB636A43E0540DA712026CED6BD59BD634743C3A10471D2D7FBBAAF962BAFFFB52DE7F845D6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...G..e...........!.........|............... .......................................'....@.............................D....0..(....@...s..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_vi.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.499322127248548
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:ZF7ysKFjncHNyb8E9VF6IYinAM+oP983nX18hIYiF9nX/qAM+o/8E9VF0NynU:LysKVcrEpYinAMxmnzYiKAMxkEG
                                                                                                                                                                                            MD5:7A22F812F92B7F00EF38A14A70BE3F82
                                                                                                                                                                                            SHA1:F1D265A2C835DCDD6225889E895EEDB7094943A2
                                                                                                                                                                                            SHA-256:B3886AF3ABCF6880516189F822DB806524564AAB38F7F9C8AF9052F632BFEA0B
                                                                                                                                                                                            SHA-512:4B82DDE7A1FBC563D7000A034AD943B7AC562CDC8757A70E1899FB418BB7EB3632A6E2BB8227F296DA503EAF16FA3398529CA7781AF606DFC31060E71CF999C5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...H..e...........!.........|............... ......................................x.....@.............................D....0..(....@..Xs..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xs...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_zh-CN.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):48448
                                                                                                                                                                                            Entropy (8bit):5.620247349904402
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:ZAURXZshAWB8Nyb8E9VF6IYinAM+oP9QNA9BPxo0IYiF9YU2AM+o/8E9VF0NyZg:HEAWBcEpYinAMxQYi6AMxkEk
                                                                                                                                                                                            MD5:66B5ABEC8E4B2CABF62B68BD265A48B9
                                                                                                                                                                                            SHA1:5CA58A3B929FC41E617F4CD205317B86E5346642
                                                                                                                                                                                            SHA-256:BBEADD3AF22684259C95C463660AF9C35BA150A00A823B419DF4C633BD1B53CD
                                                                                                                                                                                            SHA-512:F6958C4D687040E17B9A85DC59F26FF2E4B9321D05165946C744F97AB6D29ACFDC8DC531C3B68A25BEFF13BB566D73DC6FD95DA0A292B24F013C0270A27B0137
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...H..e...........!.........f............... ............................................@.............................G....0..(....@...]...........l..@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....]...@...^..................@..@.reloc..$............j..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\goopdateres_zh-TW.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):48448
                                                                                                                                                                                            Entropy (8bit):5.631167984677434
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:ZuHOldGBiuNyb8E9VF6IYinAM+oP9Hs4S4U7IYiF9cO/TqlAM+o/8E9VF0Nyq2:fg5EpYinAMxeEYiV/TqlAMxkE3
                                                                                                                                                                                            MD5:7B02084502F62AB08E9F4DDEE91A3068
                                                                                                                                                                                            SHA1:4588AC3DE96A3DE4E11E0DF0079C58D45208BD8C
                                                                                                                                                                                            SHA-256:8F04BB3D46A4BC4EB58A250296F6B8C97CA37FAC73319D7C7BD8D89CE9AC098B
                                                                                                                                                                                            SHA-512:131FC0928334771CFFEA4CB4AEDF7E993CFEA819E492033601F5025C31C900413E9E534B5982040147B2D4F3EDBB764D588E78EA217DB0CA8C34FA3550EEDD55
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...H..e...........!.........f............... ............................................@.............................G....0..(....@...]...........l..@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....]...@...^..................@..@.reloc..$............j..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psmachine.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):282432
                                                                                                                                                                                            Entropy (8bit):6.580618907494474
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:eRGm4nC4FXoZGxrxAO0e8x5q9Sj/aazvo:eGm4nXFXoZ4qeK5hZo
                                                                                                                                                                                            MD5:B5BDDAF2C405EE17FAF06640D0F27397
                                                                                                                                                                                            SHA1:4FEAD2DC9C066B21C99ACF1646D63A457E5587D0
                                                                                                                                                                                            SHA-256:94B5ADE4D93F125632A7C8DBF79F99DEA877C28C2F40A9CA47C3C660A822CE4F
                                                                                                                                                                                            SHA-512:D620835B8A46E2F0363B2FD1D0A38D58E4BAAA32F1B2DA0F8B9AB8286E031A8B4CA9077C53F88881ED827488C104D1EE099074A2FB7E4A786E8D12901EB4D2BA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............A..A..A...@..A...@}..A...@..A...@..A...@...A...@..A...@..A..Ap..A...@..A...@..A...A..A.`A..A...@..ARich..A........................PE..L...=..e...........!.........................@...............................P......P.....@.........................@X.......X...........h..............@Q... ..T)...G..T....................H.......H..@............@..|............................text............................... ..`.orpc...c....0....... .............. ..`.rdata...,...@......."..............@..@.data....2...p.......P..............@....rsrc....h.......j...j..............@..@.reloc..T)... ...*..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psmachine_64.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):359232
                                                                                                                                                                                            Entropy (8bit):6.269305509202009
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:YgW2y+X80/lGibh/Y7+Vkm5RVsMwbQYohXbBW+15qqpj/aak:/LX8klGibhA7+VlRGbQYobt5/q
                                                                                                                                                                                            MD5:7931008AC869E46D780872FDE1ED4328
                                                                                                                                                                                            SHA1:37B92B318D5252DDC9CAD22BCC37378124BB92CA
                                                                                                                                                                                            SHA-256:971C492072C6E6E6DDB0B8584059E9AF58F3B089DECB151FD860599E818AD1FD
                                                                                                                                                                                            SHA-512:E1A69A6DBF917D336F93783CB60D4D8FE5D7A2A15B2C993AA27A63DD87CFCE235BB4C9D7EC46359BA65C9D610D6CB369EA3BE5058192410C93C36B73B585A579
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2c..S..S..S..c!..S..c!...S...&..S...&..S...&...S..c!..S..c!..S..S...R..z&..S..z&..S..z&..S..S..S..z&..S..Rich.S..........PE..d...B..e.........." .................D....................................................`..........................................\......4]...........h.......%...*..@Q...........1..T....................3..(....2..8...............8............................text............................... ..`.orpc...$........................... ..`.rdata..>...........................@..@.data...LM.......(...\..............@....pdata...%.......&..................@..@_RDATA..............................@..@.rsrc....h.......j..................@..@.reloc..............................@..B........................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psmachine_arm64.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):327488
                                                                                                                                                                                            Entropy (8bit):6.0919814113297415
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:MeyV9fNJmbkqhyVVVz6a+/hRy3LZkMyeRobT28r5RIf7Kj/aaLA:fyDB/IMlG2k5au6
                                                                                                                                                                                            MD5:8A08A9BBC3817967911FAEBB23D3892B
                                                                                                                                                                                            SHA1:41D7426E52AF9E489767A87BCB3B1D0D10992BE3
                                                                                                                                                                                            SHA-256:DF412FE80FB7C2DDA4FC6067641D8A86C53A98C8E8AF2712D657AE8610AE7646
                                                                                                                                                                                            SHA-512:F5C77E3DA56FD9C9171EA04B2F28D20EB1B62EA82AD0CCE371896AF592E7B6023FC478343A4481F1D73678425257AFCE8A8A591F724E90CCB57EB72CEAF0B8DE
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................."......."...n......................."......."...........E...;.......;.......;.Q.......9.....;.......Rich............PE..d...c..e.........." .........(.......q....................................... ............`.........................................0....................h...p..H.......@Q..........p...T.......................(.......8............................................text.............................. ..`.orpc... ........................... ..`.rdata.. D.......F..................@..@.data...,K... ...(..................@....pdata..H....p......................@..@.rsrc....h.......j...0..............@..@.reloc..............................@..B................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psuser.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):282432
                                                                                                                                                                                            Entropy (8bit):6.580127272835487
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:2RGmVviIKXox+xDvAOlXMx5qNSj/aazvVP:mGmVv3KXoxefX65hZl
                                                                                                                                                                                            MD5:51529BD404AD6A93BACC2FAA88376CA9
                                                                                                                                                                                            SHA1:1891AFC0ADAD2250EB4F36988651039BC975BC52
                                                                                                                                                                                            SHA-256:ABAD43AD3E27D1E6C8611AE285AD1A7C96127DF36B98DC2FE5674B511B62421B
                                                                                                                                                                                            SHA-512:D8F63D61B6BD040FE03A14AE5DBACE73B929E9781EC64A359BF2A832F564DF6D096F0231AB0F408B60C9A6FEA1BD00B15DC0B58152F718C36F3FFA48CF661652
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............A..A..A...@..A...@}..A...@..A...@..A...@...A...@..A...@..A..Ap..A...@..A...@..A...A..A.`A..A...@..ARich..A........................PE..L...F..e...........!.........................@...............................P.......^....@.........................@X.......X...........h..............@Q... ..T)...G..T....................H.......H..@............@..|............................text............................... ..`.orpc...c....0....... .............. ..`.rdata...,...@......."..............@..@.data....2...p.......P..............@....rsrc....h.......j...j..............@..@.reloc..T)... ...*..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psuser_64.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):359232
                                                                                                                                                                                            Entropy (8bit):6.269345224951521
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:xgW2yufk0/lGibh/Y7+Vkm5RVsMwbQMohQbwfE15qArj/aa/:ObfkklGibhA7+VlRGbQMoJ25z/N
                                                                                                                                                                                            MD5:0259892D2CB710C05CFFCA79F9686FA0
                                                                                                                                                                                            SHA1:185CB66A76CD7B26AD2EAFFF6B1222A7B6C0F309
                                                                                                                                                                                            SHA-256:843DFFA160083155BCC046EBD3C99FA035044156C203A7AE191C629CD83A0EF7
                                                                                                                                                                                            SHA-512:F9A0A25C5D95584055E097593F42FCA04BB4A80BA48A5AC0D592C88273D90896AEB4C975DE72CCB93886209AFFF3F18D771CA7D948AF5BB03B277250D5ED1A97
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2c..S..S..S..c!..S..c!...S...&..S...&..S...&...S..c!..S..c!..S..S...R..z&..S..z&..S..z&..S..S..S..z&..S..Rich.S..........PE..d...K..e.........." .................D....................................................`.........................................p\...... ]...........h.......%...*..@Q...........1..T....................3..(....2..8...............8............................text............................... ..`.orpc...$........................... ..`.rdata..&...........................@..@.data...LM.......(...\..............@....pdata...%.......&..................@..@_RDATA..............................@..@.rsrc....h.......j..................@..@.reloc..............................@..B........................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\psuser_arm64.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):327488
                                                                                                                                                                                            Entropy (8bit):6.091915599984797
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:0eyV9fNJmbkqhyVVVz6a+/hRy3LZkMyeHo+TAYr5RIf7Kj/aamO:3yDB/IMlpAw5au/
                                                                                                                                                                                            MD5:8C35995DEDA169AF62A83A5F302C9EB1
                                                                                                                                                                                            SHA1:A45BE3269442DFC9A4D89EFF0003E2292349C2CE
                                                                                                                                                                                            SHA-256:0C5845A003CE6480B24712459725581839E36B00514DA26D4214853107E090D0
                                                                                                                                                                                            SHA-512:2D660FB5CEE6C99E3A6AC54872D0F404E9F7A21B141FBCC067BE40EECDEAE29AC2D1E5141211CFB704EE70BDE40C4D5336E3538F0883143245B90BBBB82F63D8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................."......."...n......................."......."...........E...;.......;.......;.Q.......9.....;.......Rich............PE..d...g..e.........." .........(.......q....................................... ......6.....`.........................................0....................h...p..H.......@Q..........p...T.......................(.......8............................................text.............................. ..`.orpc... ........................... ..`.rdata.. D.......F..................@..@.data...,K... ...(..................@....pdata..H....p......................@..@.rsrc....h.......j...0..............@..@.reloc..............................@..B................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Temp\GUT4669.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File Type:POSIX tar archive (GNU)
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8161280
                                                                                                                                                                                            Entropy (8bit):6.460371542708208
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:98304:haO8k3+oXktjNk4rljVNlKgI8YUQyn1XoJ0MXoY0jdazPbc3CkS:bSttjTjlMQ4Jg6YCk
                                                                                                                                                                                            MD5:C69E8BD5630DF92574407BB3E2C583B1
                                                                                                                                                                                            SHA1:E69D3D9BF35F7D68D36C62A6318DE932835A260C
                                                                                                                                                                                            SHA-256:84833AD5A43C284CF9136BCD0387F87F5F57A50E3FD36D36B8D67CE4CE5207B7
                                                                                                                                                                                            SHA-512:232EE15039E0C3C407A60F77E058C5BAA2D052919EAB8CBE8E48691AE783F5FEA1671687ED2A0E988F5596750298F49DE4B7DB49D89FC1C07B4F42B67509E3E8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:BraveUpdate.exe.....................................................................................0000777.0000000.0000000.00000526500.14572006453.012136. 0....................................................................................................ustar .................................................................0000000.0000000........................................................................................................................................................................MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....A...A...Ao..@...Ao..@2..Ao..@...A..@...A..@...A..@...Ao..@...A...A...Av..@...Av..A...A...A...Av..@...ARich...A........PE..L...)..e.................<...(.......z.......P....@.................................A.....@.................................`q..x.......0............\..@Q...... ....^..T...................@_......X^..@............p..\...........

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandler.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):302912
                                                                                                                                                                                            Entropy (8bit):6.698956223631608
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:vwZfu+xXz86yji7+7tzuk3vbOtQtAO4D5eUdRx+Euqu7:GfuKXznyjiC75uk3CQtWD5Xx+ERu7
                                                                                                                                                                                            MD5:565DAF0070618C3BBB1D486B0D5A70FA
                                                                                                                                                                                            SHA1:3DF3AE144DB804EAF83BC0B89ED847380D476078
                                                                                                                                                                                            SHA-256:03E2EA9C1BE863F1BD007AE03C06BF3187751A00ED0CF7C4DEB3750951E5B960
                                                                                                                                                                                            SHA-512:DED5E2D3D3CA1198A576A0947127F584156919CAE2D67A688B90EBAF11C2AD8E2C50A494052245DB8A2423F90F037886A70AE2AE42EAF3122E1B1E53699FA176
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._[HC.:&..:&..:&..H%..:&..H#..:&.IO"..:&.IO%..:&.IO#.H:&..H"..:&..H'..:&..:'..;&..O/.@:&..O...:&..O$..:&.Rich.:&.........................PE..L......e.............................h............@..................................Q....@..........................................0...2...........N..@Q...p...$......T...................@.......h...@............................................text............................... ..`.rdata........... ..................@..@.data...t(..........................@....rsrc....2...0...4..................@..@.reloc...$...p...&...(..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandler64.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):397632
                                                                                                                                                                                            Entropy (8bit):6.440229620666291
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12288:/+n1e0P+GDRxRwwbClZ+jam+oAI5BciIx+U:/+n1e02axRJam+S5upxn
                                                                                                                                                                                            MD5:22DB9D0D4FEC050C0420274D3073994B
                                                                                                                                                                                            SHA1:46FAC4589B3FCEDA6076A36CC3D3E422C05FCCDE
                                                                                                                                                                                            SHA-256:00FF35AA88B2E1C9C271365A93B019CDD3A4ACA593642712B694628D45A12C8C
                                                                                                                                                                                            SHA-512:C22C6656073B7EC51390D900ED40C6AACB0BB19134BD210E17E1D7A2C27069A33CAABC7AF76D50DEE6BF73EBA982F31DB8AE0509CA5690D2E4A07E675C471D1C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9...9...9.......2.........k...+...k...3...k...l.......,.......&...9..........b.......8.......8...Rich9...........PE..d...O..e.........."..........(......X..........@............................. ............`.................................................H3...........2.......,......@Q......8.......T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data....6...P.......>..............@....pdata...,...........P..............@..@_RDATA...............~..............@..@.rsrc....2.......4..................@..@.reloc..8...........................@..B................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandlerArm64.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) Aarch64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):372032
                                                                                                                                                                                            Entropy (8bit):6.290860581824482
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:KfMOKV6tGrZeRIigzy/zIdNyPKxtJiD6eJj3tXPPx0t1Nosmj1c5e7QTQx+4:atAZNzif5fsm25t8x+4
                                                                                                                                                                                            MD5:C8208EF35D885AF836E6740CB411BDB7
                                                                                                                                                                                            SHA1:82CD43B3E74C519AB6AB9E2495C0E217F61D246A
                                                                                                                                                                                            SHA-256:780FEDCD87E2AFC1A64EA295EA1A940EA69F74B43C625B6C85C0EECFD4142472
                                                                                                                                                                                            SHA-512:010DD5C202E313D53DCCF86964A86D5981723A28BFD64B78752FD135DEB90763A93E04A9373136DDDB19EB6109AA540EF4E30F826DF7C02EC735A65676673A88
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G.........X......X........................X......X.........N..A......A.B....A......Rich...........................PE..d...Z..e.........."..................R.........@..........................................`.................................................H........p...2...P..8....\..@Q..............T.......................(...@...8............................................text...D........................... ..`.rdata...(.......*..................@..@.data....4..........................@....pdata..8....P......................@..@.rsrc....2...p...4..................@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdate.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):175424
                                                                                                                                                                                            Entropy (8bit):6.036513000632513
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:cQPidj5By4/EeaZL8Z0BFri9WSfWJVVqH9B+bCe5kNtupnu0D6EDpf34fdjdEcRh:heaCSgfuqdB+i48
                                                                                                                                                                                            MD5:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            SHA1:184A42476F12A89731F608C7198E47BFC35A8364
                                                                                                                                                                                            SHA-256:633B554A26AD05C06DFE33A50F6D69E9160207F3168E15FFD3CB5652B1E8E9D4
                                                                                                                                                                                            SHA-512:DDB593D8A6BC515DCA7A4EADB2F50C28C8E61E9A829186BE9B9E8B19371E969FE055104DEFFD8CD5CD9B48F2468EC8B3D7BF6AEE45079E445D3FE42696E2D5A2
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....A...A...Ao..@...Ao..@2..Ao..@...A..@...A..@...A..@...Ao..@...A...A...Av..@...Av..A...A...A...Av..@...ARich...A........PE..L...)..e.................<...(.......z.......P....@.................................A.....@.................................`q..x.......0............\..@Q...... ....^..T...................@_......X^..@............p..\............................text...4;.......<.................. ..`.data........P.......@..............@....idata..P....p.......J..............@..@.rsrc...0............T..............@..@.reloc.. ............J..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateBroker.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):116032
                                                                                                                                                                                            Entropy (8bit):6.62560704966013
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:oHsWPr3K6NL3FBqrx0LHu9eU53kB+XmkM/UTmG:usWG6l/q33kB+5M/BG
                                                                                                                                                                                            MD5:612BFE378FBE209AC8584AE27640A97A
                                                                                                                                                                                            SHA1:235AEA9A968A37CFCC8FD2C25C167EE3F8091607
                                                                                                                                                                                            SHA-256:CA510F6779F14699708EA640175D8CEF89388D07BE2435D22775FC078C483E0D
                                                                                                                                                                                            SHA-512:787A576E993E8D58F96EB2B0428B02AC318EABD249DCAFF26E87E6F01282CB407879D8BF280BC398D90D2EF822FDF4D11371BC732F12D8085C50DAF7F8D97407
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f.Hf.Hf.H...Il.H...I..H...Ir.H4..I@.H4..Iw.H4..It.H...Ic.Hf.H5.H...Ig.H..LHg.Hf.$Hg.H...Ig.HRichf.H........................PE..L...2..e..........................................@.................................M.....@.................................T8..<....`..x2...........t..@Q...........-..T...........................`-..@............................................text...s........................... ..`.rdata...^.......`..................@..@.data........@.......&..............@....rsrc...x2...`...4...0..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):195392
                                                                                                                                                                                            Entropy (8bit):6.420855633369088
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:INA1+FyhLMnQtMIHh1a/r8/kGgTWZi1vnoY46u8sOMRzy+jGre:OAowhLMnQtMIB1a/ospTbohL5y+yK
                                                                                                                                                                                            MD5:F2CA542F38E6B51EDB9790369117F54A
                                                                                                                                                                                            SHA1:BC2E23A3FE66D39153CE5334F25FB218D9CE4FC0
                                                                                                                                                                                            SHA-256:ABDD09D0B7A2718FDA3FED25F0C404F228BABD83AA59148AA40BD0E4E9A937D1
                                                                                                                                                                                            SHA-512:07992FDB6B98940D403BE1AE6A7D49706EE198DF3A18771C330CB4703C4C9E83D519B23FE5CB4B1A117E7B70BBED7EB159F962AC1D7F942C8358F8DEA7F770BB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........d..t7..t7..t7}.w6..t7}.q6..t7..p6..t7..w6..t7..q6..t7d.}6..t7}.p6..t7}.u6..t7..u7=.t7d.q6..t7d..7..t7d.v6..t7Rich..t7........PE..d...9..e.........."......r...X.......P.........@............................. ...........`..................................................{..x...............@.......@Q...........^..T....................`..(...p^..8............................................text....q.......r.................. ..`.rdata...............v..............@..@.data...@2...........p..............@....pdata..@...........................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShellArm64.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) Aarch64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):154432
                                                                                                                                                                                            Entropy (8bit):6.173383322052518
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:VkKhe7NGODfqGfusU730roSnXvnaaDSNcp/:hhmNFDfXfusAxSDSNK
                                                                                                                                                                                            MD5:F0DBBAC441C6232C55D5275C77A77DD4
                                                                                                                                                                                            SHA1:6AA9207B5E119091948CF286A98138E1D9B0ACE8
                                                                                                                                                                                            SHA-256:1B9A4836FD73243ED7B472D71344CFE103760413334D0E5B947C87832332CC2A
                                                                                                                                                                                            SHA-512:9FA2CEDEC9AD950624B9782F6E47B322966605A6E412034471C0C8AE52CFBA894078F53671BB6F9B72C2D9584EA879A028EE37341A694443F1A517658B4DA4E7
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|.8.8pV.8pV.8pV...U.:pV...S..pV.j.R.+pV.j.U.2pV.j.S.kpV..._..pV...R.#pV...W.!pV.8pW..qV...S.9pV.....9pV...T.9pV.Rich8pV.........PE..d...^..e.........."......2...........i.........@.............................p............`.................................................H...x....P.......@..........@Q...`..T... ...T.......................(.......8............P...............................text....0.......2.................. ..`.rdata..v....P.......6..............@..@.data...80..........................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc..T....`......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateCore.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):224576
                                                                                                                                                                                            Entropy (8bit):6.731913745591885
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:XvFYwxiy+jCOCx2FssbcF8RLcul9+2+xwEJAg0FuRxqD2YqMR5+oZmYex+n1+P1/:XNYwBOPfbcF8qVtAOOTR5z5ex+sN
                                                                                                                                                                                            MD5:6E63E263EB7CB0A31F4800D274BD3936
                                                                                                                                                                                            SHA1:89F0AF0FB5DE7288DB94A6B4DEFB9BB474216989
                                                                                                                                                                                            SHA-256:9D8EBA8007E48AE1FFCC28129AB894814F844AB5C5D1543A3C8CF863C0F88A47
                                                                                                                                                                                            SHA-512:55C74E7F32E6CE21670BBA7003EBB00AC7A121A3A11B535F98D1AC3D35D1893449CA078FD093FFFCFD7547F99DB167ACAFB427F0057ABAA9115382BB0315998E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........bm...>...>...>^..?...>^..?*..>..?...>..?...>..?...>^..?...>^..?...>...>...>G..?...>G..>...>G..?...>Rich...>........................PE..L...T..e.....................`......v.............@..........................p............@.................................T............2..............@Q...P......@...T...............................@............................................text............................... ..`.rdata..............................@..@.data...l&..........................@....rsrc....2.......4..................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:modified
                                                                                                                                                                                            Size (bytes):116032
                                                                                                                                                                                            Entropy (8bit):6.626583684028364
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:yPMWPuHKCqLXFBqrG033M+tZnkB+XmaLNrfei:MMWtCYfqVnkB+PLNh
                                                                                                                                                                                            MD5:088EBFFD13539DBEF1204243C3558999
                                                                                                                                                                                            SHA1:4E2302B2008CD8CCA7DAECBB13D42931971890E2
                                                                                                                                                                                            SHA-256:79BAB0D36F4682194C20694F67F1B716438E7EAFBDBB83D9681259A41276D857
                                                                                                                                                                                            SHA-512:55A671BF0BAA2407D14872AA3ECAA485D2FC267AA57374A1E0871B5060372F8989FFF8444B65BF256A45D9B92568F9B69F759F8B1E5DACE94EE91FB0A7774F03
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f.Hf.Hf.H...Il.H...I..H...Ir.H4..I@.H4..Iw.H4..It.H...Ic.Hf.H5.H...Ig.H..LHg.Hf.$Hg.H...Ig.HRichf.H........................PE..L...4..e..........................................@.................................,k....@.................................\8..<....`..x2...........t..@Q...........-..T...........................`-..@............................................text...s........................... ..`.rdata...^.......`..................@..@.data........@.......&..............@....rsrc...x2...`...4...0..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateSetup.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1446992
                                                                                                                                                                                            Entropy (8bit):7.913845028849878
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24576:w2hOU0p4qlWfBTfmRfanIT6lUScOWFohEp6Vvn6qtndPVmatCkbpmp:zhOJpP4JTm5T6lkFohDB6sndPVa6g
                                                                                                                                                                                            MD5:E3E7498C2436A1570109FBE755AF1D40
                                                                                                                                                                                            SHA1:D7FB79F465D2C87EF22088327B5BFB73899FDF7E
                                                                                                                                                                                            SHA-256:498E27ED4E5BB584672992F459C0E51CD1E7345889DFF1521CCF577B13ED6313
                                                                                                                                                                                            SHA-512:4DD6025D4EBD1D4EDEEC077EE39E8704D2ED04FFD5F7AD83934A2ADA8D0E3AEFB15841B36AD0454E0C2CD6BE12E13B2015DE322D27059CB2FEA8BB7F4A247096
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........................Z.....................................................................~.............Rich....................PE..L...!..e.............................i............@..................................\....@..........................................P..<g..............Pt..............T...........................8...@............................................text... ........................... ..`.rdata..B...........................@..@.data...T....0......................@....rsrc...<g...P...h..."..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateSetup.exe:Zone.Identifier

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):26
                                                                                                                                                                                            Entropy (8bit):3.95006375643621
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                            MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdate.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1116480
                                                                                                                                                                                            Entropy (8bit):6.768405587681001
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24576:JYCOm/qiJZz4j02iDtjNDhSRXaD5O5sHG4reqc8fvT2bz9cjclU:NO8Z0jniDtjNE6Y4rNvTkz9cjclU
                                                                                                                                                                                            MD5:36C7B693D057C28F237E57964DC3D785
                                                                                                                                                                                            SHA1:468394D765AC4EA8A92C4B673D4A10C6DAA1CDBE
                                                                                                                                                                                            SHA-256:A718ECF01E9E995A189A6A0F9F6367ECAFECEB7BDA16705E8B7037AB844E51C5
                                                                                                                                                                                            SHA-512:6F3220C27BF9D44BCBA0AB1457543D29E1DD8381541624B81045D868813D5EE647035B42761A9F53D25DBFB5D00F598254E1BAF51816052929E637ED793C8E45
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......r.Y.6.7.6.7.6.7...1.7.7...0.7.7...4.'.7...2...7....4.7.d.3.'.7.d.4.!.7.d.2.y.7...3.,.7...6...7.6.6.W.7...>...7...7.7.7....7.7.6.....7...5.7.7.Rich6.7.........PE..L......e...........!.....R..........}........p............................... ...........@.............................T...4...........................@Q.............T...............................@............p...............................text...qQ.......R.................. ..`.rdata..4....p.......V..............@..@.data....X...P...4...(..............@....rsrc................\..............@..@.reloc..............&..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_am.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):53568
                                                                                                                                                                                            Entropy (8bit):5.575420072105715
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:AR+H4k4+J2HNyb8E9VF6IYinAM+oP90at2rIYiF9qmPd9AM+o/8E9VF0NyKz7P:jHZJOEpYinAMxBYiLPzAMxkEkn
                                                                                                                                                                                            MD5:550A1B340AB88809669FD17EC434561A
                                                                                                                                                                                            SHA1:0F6C12C069746DB4AC01DA97185E090FF509C546
                                                                                                                                                                                            SHA-256:3C113F4FF22B63D42E4B3351EA2952DBB1842655DD52F0F84951961CA7C303E7
                                                                                                                                                                                            SHA-512:5AD6E4B96196B15FFCFBD189AEF474DDDDBE5E6AC3FBC49BE7EA9C99A39D8F8C38FDBF7C6D0FE20B1FF0048A2E8E0BB94631FE718C507301837B9347B3A3257E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...7..e...........!.........z............... .......................................H....@.............................D....0..(....@.. q..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... q...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ar.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):52544
                                                                                                                                                                                            Entropy (8bit):5.5725435735274305
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:J0ovtkCLu+JG8Nyb8E9VF6IYinAM+oP9VtdzACyIYiF99OAM+o/8E9VF0Nydh:PvtkCLdrEpYinAMxAEYi0AMxkE9
                                                                                                                                                                                            MD5:BBC6198B60210C1578CBAA60B96FDC70
                                                                                                                                                                                            SHA1:3A19EFD437D2C35CB15F2AB2D813466E8B1066B7
                                                                                                                                                                                            SHA-256:9196D431048A4481911054ACAD58D849D9AC38715A2F164FB09CC52F5E41D105
                                                                                                                                                                                            SHA-512:D89A7F66BF6273A0A232D543FDB98CF583B0DCDE2FFF058AA018A2368D0F0918CDCB317D0729749F490D5F6A5D9D36B04F73CB8E2CC3E3D69A123808B787B0A9
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...8..e...........!.........v............... ............................................@.............................D....0..(....@..xm...........|..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xm...@...n..................@..@.reloc..$............z..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_bg.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55616
                                                                                                                                                                                            Entropy (8bit):5.5655586584292065
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:Jq/odckbeGZBOcl8Nyb8E9VF6IYinAM+oP9ax7AIFEIYiF93jjMAM+o/8E9VF0Nm:yoV7DlcEpYinAMxyL1YirjMAMxkE0u
                                                                                                                                                                                            MD5:DA09EAA0D93375AFE0709C1809C14939
                                                                                                                                                                                            SHA1:9FD4700E02BFBB7E4C890CDD59F0620FB0F9FE17
                                                                                                                                                                                            SHA-256:0BD086FFED7296FF1FD8228AED8F80B8D9A8E2402AB974A9258A86887347E502
                                                                                                                                                                                            SHA-512:392C0DEE8ED74DC12978E29F5777BF5D3E93BB0F839C156951F34EAA9A72AC9F4E132A99344D9EACCD5D98AB12CC7EA5F95DC1D503B6C6CB1F4086380AAC3A96
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...8..e...........!......................... ............................................@.............................D....0..(....@..8y..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...8y...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_bn.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55616
                                                                                                                                                                                            Entropy (8bit):5.623684706857659
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:JcKhvUx7tYF7qKF0FrHF6zjbmBwgNyb8E9VF6IYinAM+oP9ndzZIYiF9wQAM+o/i:xhrlF0FrF3BwYEpYinAMxaYi1AMxkEI7
                                                                                                                                                                                            MD5:28C55146F4311953E1CF7E468C8DC74B
                                                                                                                                                                                            SHA1:76442CD814BE3FB21A0E2E8608E564C785548F13
                                                                                                                                                                                            SHA-256:32216C7119BE97564830F8CBF4888632E7D1AC5F99AB65DA6C2E6A28D511800E
                                                                                                                                                                                            SHA-512:5E13C7820218C29F26C64C12C318E40C11759B37300793F22E08F3D828361CCB1244123610B4AFE3E9E9E454263A862D136A96E4271B51378C50E8D2F8A83D47
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...8..e...........!......................... .......................................{....@.............................D....0..(....@...y..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ca.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55616
                                                                                                                                                                                            Entropy (8bit):5.39160458880719
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:Sv2ArBupGEEpYinAMxVYiDWdSAMxkESKM:Sf397HxV7DWGxuKM
                                                                                                                                                                                            MD5:44ADDEF5DF612EF84086876FFA323A76
                                                                                                                                                                                            SHA1:CC7639439B15CAF8FC8F9240BEF8B757BB3054A2
                                                                                                                                                                                            SHA-256:108525B759F60C5076BACA70474640E1E262BF77FF3F1A1E7822198416084D55
                                                                                                                                                                                            SHA-512:7211E8549A4D6A3BD6C425DA1065F8AE0DAEE1C7325D63A8E8535FAD7464A2043CCB5F379310AB4A22C4498728F3317B79F260C097CCC652817FB521D317106F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...9..e...........!......................... ............................................@.............................D....0..(....@...x..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_cs.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.442186434885563
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:OUBDBWpaJkhYwA+fwNyb8E9VF6IYinAM+oP9gpY83AIYiF97XAM+o/8E9VF0NyFx:huIEpYinAMxZsYiDAMxkEpb/
                                                                                                                                                                                            MD5:68BF6960F7C5BF7AE817EFFC7632C017
                                                                                                                                                                                            SHA1:F828B622D95F69222B68BBA9FA9F400672C84569
                                                                                                                                                                                            SHA-256:5314C94178A6861A88792F34D924A56B5CC7214CC4351AFCBED536D5C3F13417
                                                                                                                                                                                            SHA-512:71C84ED4417ED943EF752CDAC0D9E57FCAFAD80B3B16A2EE515734BF3A12F335FB9E4B0BE86DB1B607CF4E951D4306626C15C166C11579BBD0B866756D0DE53A
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...9..e...........!.........~............... ...........................................@.............................D....0..(....@..0u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_da.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.409036773195985
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:O7aUfNnwtpTqPqNyb8E9VF6IYinAM+oP9G5rJXEuIYiF9YabOAM+o/8E9VF0NymB:X8nw/+qEpYinAMxgUjYinaAMxkEm
                                                                                                                                                                                            MD5:6ECB0249DA48684622FE633F98F8F530
                                                                                                                                                                                            SHA1:1B9990DCCCD813FAC7C5517A03E5C147816E486F
                                                                                                                                                                                            SHA-256:0A52E3DC70183D8041683817CC0514004898E87D9C080FB93374E900660BBC0E
                                                                                                                                                                                            SHA-512:E48932205ED3362B4C915C572FCAAD012205837F54520F66C33B12F9AB4179E03AEB559C18465E3C419242CF039DA5C0271FD2CBC0031F1E7C7594C71CCB75BB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...9..e...........!.........~............... ...........................................@.............................D....0..(....@..xu..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xu...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_de.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56640
                                                                                                                                                                                            Entropy (8bit):5.377480288938011
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:XKjmxUM8QtPM0Me6INK/AGNyb8E9VF6IYinAM+oP96jjjIYiF99hJIAM+o/8E9VF:UmXjMePsAOEpYinAMxaMYivuAMxkEhJt
                                                                                                                                                                                            MD5:BAEA28AE8DD3E3C70DEBCDF1AE5448B4
                                                                                                                                                                                            SHA1:F8F40C17ACE4FBF272618063BC35F2502B00ADC6
                                                                                                                                                                                            SHA-256:4C2DA183A792B13077B398085CFF930CBF493B8CBEC50609F2BC6747F0B8092A
                                                                                                                                                                                            SHA-512:04DE4F7FA8C4A625724337539EFF093E2371ED417A6363833E7F65CBD14C9A0F64BB17EF1BA4BF51A16D6611E8240E4D2B248E4622BAB462DC331459DF64C851
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...:..e...........!......................... ............................................@.............................D....0..(....@...|..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_el.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.627688222986176
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:8Zr5lLO+R52/g4EpYinAMxSKYidzAMxkEd:2rl7207Hxt7dzxJ
                                                                                                                                                                                            MD5:5FBDD326F7F291BE11E1D79A7B2C8A51
                                                                                                                                                                                            SHA1:5701E5D3496F6D2F0C694D317F568A63990C311F
                                                                                                                                                                                            SHA-256:1CB97FF90568D81F8CC9E6A2EAFB07EAA276834169365980279403D99756103B
                                                                                                                                                                                            SHA-512:01BC099E7C875D6A0473F6FF577F14F3DA3123951596B5651BC757B6A2C10F293078452BB42A87084C3B862D4A0CD56129670234D2E9518E76379C534B534AAB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...:..e...........!......................... ............................................@.............................D....0..(....@...{..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....{...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_en-GB.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):53568
                                                                                                                                                                                            Entropy (8bit):5.419932966591344
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:Xy1/Nagyh6QuZNyb8E9VF6IYinAM+oP9p91J3ZIYiF9fAKAM+o/8E9VF0NyUNk:uNagyhi9EpYinAMxVGYiQKAMxkEYk
                                                                                                                                                                                            MD5:4396E672BC6FB86EDB0C6889D12CE082
                                                                                                                                                                                            SHA1:C92279D00DBC2DC0EA13E3A8896EDA76A359723D
                                                                                                                                                                                            SHA-256:F35E94567279C322EC1D4BB99EAA1327FCAA1F06F4BD9D1CEF8C897FD8BDA8C3
                                                                                                                                                                                            SHA-512:45F40EACE1C0398EBCA42EFF48DE6208BC87147837459AEE6D882CD017A9069CAD2EBEFE8B1EF0D27F36981DDD963416F0B7B5A26AF98A84B6CB64666638D0D3
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...:..e...........!.........z............... ............................................@.............................G....0..(....@...q..............@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....q...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_en.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.398655575356968
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:8VgzagyWk9RUNyb8E9VF6IYinAM+oP9BCDvCIYiF9L3qc2AM+o/8E9VF0NyQr:NzagyW4UEpYinAMxmYiOBAMxkE2
                                                                                                                                                                                            MD5:364F97EE7B79DEB51DCC8F5EC4A0EE7C
                                                                                                                                                                                            SHA1:EC4CACCAA57714FA8B9869315B6B13C530587E2D
                                                                                                                                                                                            SHA-256:DE1E4766E0A2C188604AB2927025E1F5B05CEBF7E7B20E8342B4206686A7EB96
                                                                                                                                                                                            SHA-512:43894949B412A8ECA8032F68DAC6C9208D9297B8C0353B9BBACEFE13343BB94343569F4CBEE1AC2B90971C8E2CC81408C55FC57DFEB94A6297D28CBB43E4D1E6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...;..e...........!.........|............... ............................................@.............................D....0..(....@...r..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_es-419.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.391103646647603
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:8Uil+fs4INyb8E9VF6IYinAM+oP94Y6uFkJIYiF9EW4EVdAM+o/8E9VF0NybJ9:Il+fs4gEpYinAMxnZYiWELAMxkED9
                                                                                                                                                                                            MD5:C2E2C6690755507979F570CA3E92E903
                                                                                                                                                                                            SHA1:F82052FC3D2C97C18CCAE91CB64C91F02DC09AC5
                                                                                                                                                                                            SHA-256:FD60F26D62F58D1AA41D11A8AD3086E2A0D92EF22AC766F606AEB2BCC3B217EB
                                                                                                                                                                                            SHA-512:319A6418576BE4274269F533A5CEF62F9020B606494F3C7A5B299957931B919A86507F7888EAB5C6BB952BC65DAF76AE89439E72778BF97F77B30B520E904148
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...;..e...........!......................... ............................................@.............................H....0..(....@...v..............@Q......$.......T...........................`...@............0...............................text...8........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_es.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56640
                                                                                                                                                                                            Entropy (8bit):5.365606356097874
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:86qBkNzf1FNyb8E9VF6IYinAM+oP9FVIrIlppcIYiF9kSx6AM+o/8E9VF0Nyueu:KBkNj1BEpYinAMxI2Yi1oAMxkEq
                                                                                                                                                                                            MD5:91C76FBA7736D06307708EE572CB9ED4
                                                                                                                                                                                            SHA1:64764FCB44F18104E7554D8091BD0C7EDAA9D1A9
                                                                                                                                                                                            SHA-256:D62078627149F4B5B90EE68B56C640CE120519F2F0438FC136AF225510CBD343
                                                                                                                                                                                            SHA-512:F789D42681BDCEE52CFD342F019A16396DAE0E3F8C929A1A004E1F9F960EC94BE72B40E8D22A0DFEDA1F743564568F457EA64A6C6E5074F323C4655964402097
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...;..e...........!......................... ............................................@.............................D....0..(....@...|..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_et.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.407227689072818
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:VYBW7bDFbDZETJ9TSQMNyb8E9VF6IYinAM+oP9I6UwqLYcIYiF9sx5q7AM+o/8Eg:Sm96nHMEpYinAMxTYiOYAMxkEg
                                                                                                                                                                                            MD5:9599F4AEE019804B418245C5A86881C7
                                                                                                                                                                                            SHA1:517D4DDD90361B89359BCCC174D9A6ECDA391426
                                                                                                                                                                                            SHA-256:3023BFEDCD84AC065A38C4C6C983CCFAA0B3D5C02A610C6CA2EA00FD5545DABB
                                                                                                                                                                                            SHA-512:613C6F11D11D84C1208B1CD7BDF030C3D2F5B90BC4D134C6E0584121B688AD14B01CE38C56501898962F5C859A8AF54248E86F510C20F3F7E0415163FFF95F14
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!.........|............... ............................................@.............................D....0..(....@..xr..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xr...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fa.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):53568
                                                                                                                                                                                            Entropy (8bit):5.562768970202109
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:VCYQOZMK9Y5fNyb8E9VF6IYinAM+oP9eLcfiPdwFIYiF9EbrJAM+o/8E9VF0NyXe:c1VBjEpYinAMxMcqPVYicxAMxkEg
                                                                                                                                                                                            MD5:A09A6C8DC7CEFC6CB126939947884678
                                                                                                                                                                                            SHA1:16F90FF84A3CD8C98304459007C7D05A98D05CC0
                                                                                                                                                                                            SHA-256:C5CFADFE624A0B92B45B121DC30D06D89150BDB03FD45B4FB7B4534BBC7EB40E
                                                                                                                                                                                            SHA-512:AF6F3BE99AEA54D26E933C98695644596D814E4E8B880E5CE081093A474FB8DF973853DE5220E498ADC84FF752CFD1CA4165771F04048CA9ED7CB6C179050798
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!.........z............... ......................................q.....@.............................D....0..(....@...p..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fi.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.408662294317196
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:V1HzPEzPhXY7RzYd99hKh1GAsNyb8E9VF6IYinAM+oP9BSzehCaIYiF9ca8lAM+c:PzPEVmKgsEpYinAMxqzTYin8lAMxkEsI
                                                                                                                                                                                            MD5:1DFC8B3110BA27F76C5C6495533AF538
                                                                                                                                                                                            SHA1:DD60677F7AED0FBC06877333136562EDAF0BAECA
                                                                                                                                                                                            SHA-256:60A159777971A84302E150866CAE1339ADC04939BF12B7B2367243361499BBF9
                                                                                                                                                                                            SHA-512:37674C26A179B839239337219EAF8F78AEAC10425DE5E7CC5A91B140B816410EEC5C4DE84E7BE825BA4CED3AA41F1B421B1902D26C5A9384C725C5682017ED72
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!.........~............... .......................................G....@.............................D....0..(....@...t..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fil.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55616
                                                                                                                                                                                            Entropy (8bit):5.386310916321289
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:D7U9w+B3RVawWrEpYinAMxmR7zYiyOAMxkE8e7:D6w+B3RVawf7HxMf7y8xN
                                                                                                                                                                                            MD5:20152624A1FF01D9F2BAC28D7B00CCA9
                                                                                                                                                                                            SHA1:A320967BEE24E07725E3AC2DC2F66F264F1B9221
                                                                                                                                                                                            SHA-256:80063F2CA78C9C757FB06B36F24F0347992DD75D300C4FB4A0DAA90D31B83A2D
                                                                                                                                                                                            SHA-512:A9334CC7D97A212F816EEAC0EBE8D6A5CC4B83C72DC10C34682AE504EA9690C077A84246DBA1462E991C609431CC93B085ADC14DAE28D468B537305161D56EF7
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!......................... ......................................-.....@.............................E....0..(....@...x..............@Q......$.......T...........................`...@............0...............................text...5........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fr.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.3857985161200785
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:qqov98EoycpW4xUNyb8E9VF6IYinAM+oP9HaOp/IYiF91ihkAM+o/8E9VF0Ny3j+:OvaycNUEpYinAMxoMAYiAhkAMxkEt+
                                                                                                                                                                                            MD5:7704C15C3F3F312CAF2849DC2EAB0E78
                                                                                                                                                                                            SHA1:E3C673D407464CCB1E2DF5FC357D814C61213F7B
                                                                                                                                                                                            SHA-256:FE634E2F6C7AD7BAD17BD0A956B612BB14A9064B98CF5B5E013E08AC19204744
                                                                                                                                                                                            SHA-512:704A7541B55962E0DB1BF9388DA3F8A2AE1AE284AA60409D5FBC30F9BE275658D10C2DBFA80DED9F12632DA0F4F076925B5658B4F16EEEDD5320AFEADDEDCE85
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...=..e...........!......................... ............................................@.............................D....0..(....@...z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_gu.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.61051850410968
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:q6qm3UbeAV4DnYCRfwmkIPNyb8E9VF6IYinAM+oP9iCpiA4RpIQnBIYiF9jdiAM+:EUUbe7hbzEpYinAMx07nWYi0AMxkEoem
                                                                                                                                                                                            MD5:41B7CEF8A631E5F9FF1B54F6B0CE13E7
                                                                                                                                                                                            SHA1:8B695116808D99DE0B49EB54FF8AFA9A6E81368B
                                                                                                                                                                                            SHA-256:3B5FFC2C6DCE2BE431CF686FCD2D2CD39FF003D42AFC27887CB128B34CBEE354
                                                                                                                                                                                            SHA-512:15E72B1B3FDEB5A7AC2C4AB044224D25521A820AE62C725ECCAF6E3E2C1CDB24F9EAFB3AA12E1C1ADB042E762D49E0FE6A3B81280D1E5346BCDBDFFB8712B6FB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...=..e...........!......................... ......................................1.....@.............................D....0..(....@..hz..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...hz...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hi.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.584260993420684
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:j4x6AN6AQqjexbyqKXhHqC1EpYinAMxlcYiXl2AMxkEb:j4xXc7Hxlc7VExH
                                                                                                                                                                                            MD5:5EAF10368F71EF58845D728B1C35DEDA
                                                                                                                                                                                            SHA1:1D525E25F5B1B2546285B0BCD18BE0D2F81F17A5
                                                                                                                                                                                            SHA-256:E9FBEA12B32D02160D14370501A622C032114C592EF7C5BF94EB620283FCB6D7
                                                                                                                                                                                            SHA-512:94B31603651BC5A3BB51E44E07AF1BBDB4B6D9EAF5B0AE7584525155224F23F653AFEA2DDA885620C6362D8CEE6189C5B6C86C2D76E2CDB541415A604A4B1FE3
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...=..e...........!.........~............... ......................................#P....@.............................D....0..(....@...t..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hr.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.402610840778619
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:TsfBpdOXz19szMH5KBL/yNyb8E9VF6IYinAM+oP9I2ZlxEIYiF9GTJAM+o/8E9Vz:GBK5oL/SEpYinAMxPYiSJAMxkEn
                                                                                                                                                                                            MD5:615FEEC50393BF657E7B84A864D534A7
                                                                                                                                                                                            SHA1:0D3807C4E28D0121C43B3A910BD4538DEEC70B5E
                                                                                                                                                                                            SHA-256:6EB847167FF384D1D30B6D16939980DC89D95547A18CBA91136CE66CEF6C06B7
                                                                                                                                                                                            SHA-512:76FEF42FD098DAEAC39B495C5AF7E71784204936D4D75483BB49678C3995C7FE0FC3B75F5D2E034FB974AFCFE45FA4158801C92F0A55441C5E8CD34647142AFA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...>..e...........!......................... ......................................T.....@.............................D....0..(....@..@v..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hu.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.425116799449756
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:Q17U791C2TzpwGFTbZY6d1lBVZ5qAy3FGd7HxQ74xXa:Q17U791C2TzpwGFTbZpd1lBVZMAy3FG2
                                                                                                                                                                                            MD5:E200F70987E56CBDFF8C6A587A02705F
                                                                                                                                                                                            SHA1:8C135AD82792C337445DAB4677B654C7390BF36F
                                                                                                                                                                                            SHA-256:B285107D2D2F2D64F2F060CF57E29B08C5DD9498CE8CEF83ED7C30032CE4625F
                                                                                                                                                                                            SHA-512:81163C216A1D4FB7B328D4982F4A251601242320EB413B88F423CB133526484667328716D368DAC110E6E2E4715814A8A1A85BF56A81C42DC8E48049DECDC767
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...>..e...........!......................... ......................................_.....@.............................D....0..(....@...v..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_id.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.402370571282084
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:TxFmhL3THRNkAHqQ3lFRf2I9ByrUvNyb8E9VF6IYinAM+oP9Lfu7byIkdIYiF9X0:WXhR5TEpYinAMx8oKYitAMxkEc5
                                                                                                                                                                                            MD5:16C771FF09E9BCFE7FD617C0F5D489AA
                                                                                                                                                                                            SHA1:55AC69B62DD357DE4884A95F95786AF979F2CFE2
                                                                                                                                                                                            SHA-256:6F747BB6BCF0491A3B7F2F04B802C41BD895A01D94F11E7E5B6721B17DEE26F7
                                                                                                                                                                                            SHA-512:D85B041F62241EC6F4685372895200FECCC1F277F1E0D4A5015AD79CEA12FD19BB4B864EF871A4F6D7B4C0D887F4F92FAB74BFDFA7940B07866B063464749C4F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...>..e...........!.........|............... ......................................z2....@.............................D....0..(....@..Xr..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xr...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_is.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.42997837750232
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:gJqibAIErkUVQF5UefV3BEpYinAMxxYiPAMxkEA:gJqibAIErkUVurfVa7Hxx7Px0
                                                                                                                                                                                            MD5:1844776B1E873892CB6D453EBCA334A2
                                                                                                                                                                                            SHA1:6F36F4BF2CE6D286C0E1E59041EE506BBB96ED7D
                                                                                                                                                                                            SHA-256:98E823748DC2E72B8B5A46827D501E12C9C48E209643F2DD6B4B8D333501DF8E
                                                                                                                                                                                            SHA-512:8C48EB7CC40EF6798C9789A9B860BCF508D3740E948FE64E1197A422CFD240A6430FC36B5AFC23A5C1CA73FB155003B22A57AECEB207741BC9EBCAA947A411B6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...?..e...........!.........|............... ............................................@.............................D....0..(....@...s..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_it.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.3695383590059125
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:4SIlDIN+shh3+Nyb8E9VF6IYinAM+oP9BNgIYiF9zMAM+o/8E9VF0NytlR:UVIN+q3GEpYinAMxPYiIAMxkEP
                                                                                                                                                                                            MD5:E7A5254E3C732ED21F756B90EE6C73B3
                                                                                                                                                                                            SHA1:EE2C5D342E51BE27750F5C855A9437B6BF3FEB86
                                                                                                                                                                                            SHA-256:9342ACA1761B4F81F8771F19CB4A1ABD77F392194D32758FF42B98F8AA3D6CB5
                                                                                                                                                                                            SHA-512:75F83A5905F8254E4FB352D00B8173D2A5614C17D166C06AB87C0B67C1C7BDF99377C7BBB89A85E6AFC5F0E5F8A045E45D64B2B157A413E871C015EB65D46F3A
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...?..e...........!......................... .......................................a....@.............................D....0..(....@..@z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_iw.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):52032
                                                                                                                                                                                            Entropy (8bit):5.602368818487498
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:4cKIv7hdVexaDywGfJssDNyb8E9VF6IYinAM+oP928tt+fIYiF954AM+o/8E9VFt:EgNM1fEpYinAMxZRYieAMxkED
                                                                                                                                                                                            MD5:0DC19E59ACEDB7D103D0C21B02804661
                                                                                                                                                                                            SHA1:477FEAD06B9DDFB85185DA85A640E6BB467FC32A
                                                                                                                                                                                            SHA-256:17ED8A04CC1BCAB734F23140BFC8145BD0D038C284D50F439DAD1E66F7647C22
                                                                                                                                                                                            SHA-512:20F3E9B58E9D5AE3F08096ABD5D5A43DB93238FDCDF2E96126A4B4AEB06BE2C8ADDDDC6601136EA265770AFCC7F4BE41E20F1D28CA361FE0135FC98BFA71F392
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...?..e...........!.........t............... ......................................nn....@.............................D....0..(....@..@k...........z..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@k...@...l..................@..@.reloc..$............x..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ja.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):51008
                                                                                                                                                                                            Entropy (8bit):5.615534777551888
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:hz7iEHj0FgWGNyb8E9VF6IYinAM+oP9EimJIYiF9mRDxAM+o/8E9VF0NyzCU7rR:RiED0FgWOEpYinAMxHYiWDxAMxkElt
                                                                                                                                                                                            MD5:6C6093A914A889BC15133A57DB09C395
                                                                                                                                                                                            SHA1:A8F9D54288D636E586271D78E7CF69E9E0121E16
                                                                                                                                                                                            SHA-256:EC7AF1E9B03241F85A99F9C807FE279E322CA5528DD08B33F65D0CEFB8F04EED
                                                                                                                                                                                            SHA-512:3548503A8395ABD3D19D3FFEF24832242F6F6C742678C0657FBF795DD14584B9F35BE5B02D7BC6657D486E63609E0687C1E277857DBEFCE6AE7D97E6E135605F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!.........p............... ............................................@.............................D....0..(....@..@f...........v..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@f...@...h..................@..@.reloc..$............t..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_kn.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.638575498464374
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:hgLfUIRBSWNyb8E9VF6IYinAM+oP9BGv0Xs8fIYiF9ngp+AM+o/8E9VF0NyNwZ:cfU8k+EpYinAMxq8TgYiop+AMxkEo
                                                                                                                                                                                            MD5:12B9BE5F0923BB2313C68BB46A069F4F
                                                                                                                                                                                            SHA1:150A975918C1435027F295A06058C5BC110B4AB0
                                                                                                                                                                                            SHA-256:DCBA408E4AFDC0831CB26D08EC05EA0616F14071E81ABAC8FE5676636C2EE151
                                                                                                                                                                                            SHA-512:1CFC30E83851456DD3A5925925E34AC12F7148E20F487CDB82E0F01E06DD77B6411CF03B2094C11DF9566B1228A97024065A78F77100493902BBBEFDF6502D27
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!......................... ......................................n.....@.............................D....0..(....@...{..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....{...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ko.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):50496
                                                                                                                                                                                            Entropy (8bit):5.652443774196828
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:hUELKTd4IY+N1vZsYoRHgA12plxB4xRkkTY1M5tkOANyb8E9VF6IYinAM+oP9cbA:HLKWmAf/jv4EpYinAMxhOHYiSAMxkEp
                                                                                                                                                                                            MD5:10BAD5A24446C6E00AD2C18D09B000E0
                                                                                                                                                                                            SHA1:FA030AA1F64894829C0CD8211488B38A18D12297
                                                                                                                                                                                            SHA-256:91649E91509AA7200BB669AD2F5F6788EBAD7C5AA2CA6D7BB855E9FD96D010AE
                                                                                                                                                                                            SHA-512:6AA1E426BF7AA470058810F0515A94C1F6D624B4FF3D99BBA09C850FD17DA4A2C2C50BDEF44AA28BBB3358486844520C46482FD7295B9EE50CCC8449940016F6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!.........n............... ......................................P3....@.............................D....0..(....@...d...........t..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....d...@...f..................@..@.reloc..$............r..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_lt.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.426785047163885
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:X1ckHz05TmDq09ZEpYinAMx7b+YivPAMxkEkt:X1ckHz05+i7HxG7Hxwt
                                                                                                                                                                                            MD5:74838014C6FDA1D53C8EDC8679F9D28D
                                                                                                                                                                                            SHA1:491C640873E70CD0C703C57DB6F0FDC941CBE7F6
                                                                                                                                                                                            SHA-256:6AAC9D75D6D02884C5CB5EF33A4BD1801D9BE70DD937C624F21E492F64CADF68
                                                                                                                                                                                            SHA-512:ED792A4B625D889D8D17AD1DD23D0CC015F28B3DBCA5CD6C525E8C814996B1F806855AC4B9D59758306BE5F6F0C09979D1ACD64332E24F4C3358C5FD6857A22B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!.........|............... ............................................@.............................D....0..(....@...r..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_lv.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.43355377301059
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:GQQpZyAxOeK6eDNyb8E9VF6IYinAM+oP9l4ZCIYiF941WAM+o/8E9VF0NylkC:IdufEpYinAMxWYiSWAMxkE0C
                                                                                                                                                                                            MD5:8FA152CA88C3108EFE077F57482BB42A
                                                                                                                                                                                            SHA1:B27058398730B18E39D9E16FBFBC5625AF403FF8
                                                                                                                                                                                            SHA-256:01C42EB00F2E6566D3FFF4AFB0B2C2FAF34C14A1A61E29DB86B3CB76D4EFBFDC
                                                                                                                                                                                            SHA-512:81620FD3D80A1C245BCBD643D1B579E3D413B3A0011AC65F39CE31929908FCD95C1D4C0D5BA89A1F907E02E351CE5EE2CE79B61E7176CA9706908BCE7A4BF59F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...A..e...........!......................... ......................................n.....@.............................D....0..(....@...w..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ml.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):57664
                                                                                                                                                                                            Entropy (8bit):5.590444403006137
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:G3zU3B7FZygp8/JLONyb8E9VF6IYinAM+oP9OFIj5iIYiF9ImPAM+o/8E9VF0Nyv:JRWJL2EpYinAMxpYifPAMxkEeC
                                                                                                                                                                                            MD5:F693B959CF8C7341020D18ED345AD74B
                                                                                                                                                                                            SHA1:FD57E1806796F23C639531E6DCC165FCEF4F37BA
                                                                                                                                                                                            SHA-256:0B37B36D43D032BFB68F06173107AB58E8C17904C3D1247C32690E168FA922F2
                                                                                                                                                                                            SHA-512:E474312498C874EF53A1FCC75A9D28A35341577BDBF672FB3D82D76A2BD9BFF6BE9477A61C64D1EB434FCB9FAC7B65912E033FDEF8877A681C614A035C01E347
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...A..e...........!......................... ......................................c<....@.............................D....0..(....@..x...............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...x....@......................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_mr.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55616
                                                                                                                                                                                            Entropy (8bit):5.588716592426551
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:GfvCdo/7JK7bABkCNyb8E9VF6IYinAM+oP9644k0VwIYiF9QqoAM+o/8E9VF0NyZ:uYo/7JK7b5CEpYinAMxmvYivoAMxkEBV
                                                                                                                                                                                            MD5:0DC5183697F790CF937860F9F8CCF8BE
                                                                                                                                                                                            SHA1:531C04F6AA3B363A14740CC33D1E4D98BF857BC7
                                                                                                                                                                                            SHA-256:8176DA09CFF7F0BAE0AA08430CC4CA093A68627FB631A377DF0EC82959E7F634
                                                                                                                                                                                            SHA-512:E58A71558240BEE892FB783E061BF481CC2F56F01BFA5F7A2C50C0EC69B2360AB9564E80C3D34ADE0296DB1D9509861484A3D6AB3936880AF9D23CE13FF1A373
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...A..e...........!......................... ............................................@.............................D....0..(....@...y..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ms.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.4114238474999805
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:Pr10IePeyrQLtUv6oNpaMkYjZZ/fbMgTRlREDNyb8E9VF6IYinAM+oP9LeFFjUIX:qjTZf3TFGEpYinAMx+jlYiFAMxkEj
                                                                                                                                                                                            MD5:742CD3150B436B909E5AD9AB6F22783C
                                                                                                                                                                                            SHA1:474B8B3B75CFB25C90EB33E8E4BBCCB07068DC8D
                                                                                                                                                                                            SHA-256:E537F7AB167D50E347B359AB848C46405C7FFD067408E896858C31AA99E6B228
                                                                                                                                                                                            SHA-512:CDD492F93BBE49F17DC8DBAA19C1FE1FB1B3403054703D20402B07A42BB5D5F5D20F1D126103AF0DCE62EA36299835902E7FAFF96EA5D7EACD59974E6F88A2F2
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...B..e...........!.........|............... ......................................?_....@.............................D....0..(....@..Ps..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Ps...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_nl.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55616
                                                                                                                                                                                            Entropy (8bit):5.380500350214481
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:P/kLXd/T3kXNyb8E9VF6IYinAM+oP9e8Kk6U92ZHIYiF9524AM+o/8E9VF0NyZwS:ULtgbEpYinAMxPSUTYiFAMxkE0S
                                                                                                                                                                                            MD5:A54633E30C2FFD23C3578C885E0E9F5F
                                                                                                                                                                                            SHA1:662988663B27C21A0CC310D304346466EADD76A8
                                                                                                                                                                                            SHA-256:3FB8523B91B2BFEE51CA2EA972ADA260F27BA389EA9E1DD7CB8411F21F126CA2
                                                                                                                                                                                            SHA-512:AF9213815F634BC3A1DAFDF0D2BE537E4634D690C118090A81DB1138130504B4EFD27D9D0599F7295B06A5BCCE44B71E200574E583C820E820CA84D72D6E492B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...B..e...........!......................... ......................................D.....@.............................D....0..(....@..hx..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...hx...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_no.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.41113033461094
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:PZ75JZSiyCSiykeRAYiTvaK3Q3Nyb8E9VF6IYinAM+oP9P+6kIYiF9+60/AM+o/d:xeCYGiK3Q7EpYinAMxtYiWlAMxkEh
                                                                                                                                                                                            MD5:A78998736B54EC264AD3FA9529693C8F
                                                                                                                                                                                            SHA1:4B468CCCB8AC25C9E9C05161DD5C44E08504B41A
                                                                                                                                                                                            SHA-256:EB3F06A4EA447CE64971673C50CCF83E2842303F1A27655F3A170495C94B71C6
                                                                                                                                                                                            SHA-512:F747EC1B69B931D90EF4CF31A5F8E7BA95B6AEC7B36299A0E988B1D4790F42BE8AF698FE66032324C9634E5A44FD251D7BCBFEF9C5529E7D2368FFA38CEB5962
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...B..e...........!.........~............... ............................................@.............................D....0..(....@..(u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...(u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pl.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.433825393956769
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:Uym9mn7KZHCCA7U8Gp6hNyb8E9VF6IYinAM+oP9LK5SIYiF9YjAM+o/8E9VF0Nyi:SUy3AIylEpYinAMx0YiCAMxkEU
                                                                                                                                                                                            MD5:E73CF3871B41E0C59440C8D709CCFD75
                                                                                                                                                                                            SHA1:8428813368197AEE8E3C2BF2104297476BC4608F
                                                                                                                                                                                            SHA-256:AD124B0646894F3BFCB61D366D7BA5EDF4978766807B5422AD1778509231679F
                                                                                                                                                                                            SHA-512:A31E82503BB3D8E1DB9EF4C1030ECD481396183CC64905FAF91E52F9C3E68469FDF3A850357AD70466D2810855D2B58E19B9302499D2547F85A610B1F8159FF5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...C..e...........!......................... ............................................@.............................D....0..(....@...w..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pt-BR.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.4115414787256
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:UYnLplZcOZX8mNyb8E9VF6IYinAM+oP9m675zIYiF9cHymAM+o/8E9VF0NycBM8s:3bguEpYinAMxJiYiEAMxkEI7s
                                                                                                                                                                                            MD5:0227D71A996FAB2B394DFB17A43F1F8D
                                                                                                                                                                                            SHA1:DA6002C093911114035CBD5D7D29FA51E3DF2C45
                                                                                                                                                                                            SHA-256:290A463B8B11E5F5C5D3BCC2B5B8D910721BA645E2B4B3AF951223F76610BEDF
                                                                                                                                                                                            SHA-512:FB95F13C4AC6A7B8AD13F271EE3D93ABBD5E0713F0C0DE402D7B73EC82B483A26C6B071ED5521914E34E74AEF168F9FA0762801FB37EAD9D05CD3D675AE2CCFE
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...C..e...........!.........~............... ......................................W.....@.............................G....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pt-PT.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.392362813870133
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:UaAtOstnEx6ewB/Nyb8E9VF6IYinAM+oP9/KlAIYiF9J3ReAM+o/8E9VF0Ny1SX7:w/Ex/UDEpYinAMxGYiNgAMxkEC7
                                                                                                                                                                                            MD5:962BFFC6EC3DA987471851A4240AEB61
                                                                                                                                                                                            SHA1:BA1B8AFF4FACD861553039A256A7623ABF30CD66
                                                                                                                                                                                            SHA-256:3BD318A0867F1C971DAAE6A96C6EF2A09FBFB15EC5B3706DA34453410EA1F4FA
                                                                                                                                                                                            SHA-512:D975EE07C82CD658E4A3B6CF67BBD8FD41D989D718E5EAD479E0250BC3C66A933FD0E8B1DA468E0C906986AEE58E3C0F148E4F8A23B19121844F5847E1AE14D8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...C..e...........!......................... ......................................K^....@.............................G....0..(....@...v..............@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ro.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.412695960496245
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:5nCRNNDM7qm0GdVqT541naEpEEpYinAMxmYiTAMxkE0:5VdVqlca67Hxm7Txo
                                                                                                                                                                                            MD5:54B9FDA6AB88DC9EF0F0C8B19EA06CD0
                                                                                                                                                                                            SHA1:C34D52741A8986FCF0991A4CECFE1B2A7C6E85AB
                                                                                                                                                                                            SHA-256:1F00F564F1136096FBE58EFDB22E54923E090BA3392CDC51C837A7294A3FD5BE
                                                                                                                                                                                            SHA-512:BEFDF3BAED01EA905751CCE248E854CDC43D5A9D77B2EBD27E68C297464A5A0AC1ADF739E8371F0C731A5A7ABB83E6FA227D11120F70D668113F69612D44B6E9
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!......................... ............................................@.............................D....0..(....@...w..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ru.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.578353591774595
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:tlWSFA47AvHlho4d2hNyb8E9VF6IYinAM+oP9Hn737IYiF9iFAM+o/8E9VF0NyfL:qvvHUlEpYinAMxF0YisAMxkE+No
                                                                                                                                                                                            MD5:DD650BDAB776FD3239AAD311BC8CBBD3
                                                                                                                                                                                            SHA1:583A340581B2A78DF490951FFE6A7BEEBB51BA11
                                                                                                                                                                                            SHA-256:475B114201EC72F4EF26FC66B61AF438CE77F69E5E96D3CFC8FB00BA148AAC51
                                                                                                                                                                                            SHA-512:862313704DFFAD1AF1FA72D8F9F1FE4757A9A1082BE41C78E5C307C56F36D986D1F5580922800050E08BB37ED2EB18A6FF629131199E41350A22EA230DD6DC9F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!.........|............... ............................................@.............................D....0..(....@...s..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sk.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.437717171626643
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:t4lmP8uhJPiR6gLTmNyb8E9VF6IYinAM+oP9AWB5BGJgVIYiF90xFNAM+o/8E9V2:uMF8RjuEpYinAMxlgqiYicFNAMxkEAR
                                                                                                                                                                                            MD5:DC24DAA70A6551CD038929F3EC055306
                                                                                                                                                                                            SHA1:99843D43C0CC3D4C76A5C817CA4DB49820820C65
                                                                                                                                                                                            SHA-256:847440B8D60A11DCE3E254916E5CD926D58C9F06F0D95436B62FF9B9AAAEF4B0
                                                                                                                                                                                            SHA-512:451C21F435A451CC4C47623D028B1CF3939CB59B9F9A6D6D71B2F94F9B4CFD487A8756ACFF27768B454F23F2D501E9AFC67E586F9C005142CBC712E5CEDC2D9C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!.........~............... ............................................@.............................D....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sl.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55104
                                                                                                                                                                                            Entropy (8bit):5.399846673022657
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:tkcnTcshVyigOHHTpWBdH1i2IXousrNyb8E9VF6IYinAM+oP9z5XKiS9IYiF9JJd:v+hOHHy1YZsnEpYinAMxfXvYinAMxkEP
                                                                                                                                                                                            MD5:FA0AFF0B7EFD37A6195AA454012095E8
                                                                                                                                                                                            SHA1:EF4A3CA1608A8FD5DE56B2B94DBD46304480B375
                                                                                                                                                                                            SHA-256:7580B1B666C4A6DE0EB5AD03DAFB2F9FB49AD148754A68611E9988ACBBA5023D
                                                                                                                                                                                            SHA-512:FB5A73B6134F991FC2E5D9A82B747C821074BEF86A7651638FC0127BEEF78B817811BB00417168BB937F968D55D8356AC0D19C2B569A6B9B31A10531683466CF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!......................... .......................................v....@.............................D....0..(....@..0v..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sr.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.573738261423414
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:CT63FOxCx7UjYN3tGGNyb8E9VF6IYinAM+oP93kDWvSpIYiF94yIj/AM+o/8E9V1:D3TUj+dGOEpYinAMxoCYi8/AMxkEq34
                                                                                                                                                                                            MD5:D5D54965E6FB81875F2FCEA8F21515BA
                                                                                                                                                                                            SHA1:87F22E6FA6D34CAA26CAF427D5F339880496EFE1
                                                                                                                                                                                            SHA-256:759CC7CC96EA181926AF2F6B274CDB9BF63E329FC32A7A1C10B4CFDEE786F2A6
                                                                                                                                                                                            SHA-512:308068EB57F007A4674BF5D90C9410BACC715E4AE537ADEC4CAF7F6837544D5526C676BEB2B1488090E7D9F4E966F030709C2934DE3A64E0A9059CE49D1F6A14
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...E..e...........!.........~............... .......................................x....@.............................D....0..(....@..Xu..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xu...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sv.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.415346681858155
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:CeC7xC7Ec3EINyb8E9VF6IYinAM+oP9Up1XIYiF9+kAAM+o/8E9VF0Nyu7:E7xCYc3EgEpYinAMxqOYioAMxkEG
                                                                                                                                                                                            MD5:9C09AE8A870215FF9CF80F09D44F5610
                                                                                                                                                                                            SHA1:2EE0328D7617A3D5A46C432DB2AE8BA2D335CB10
                                                                                                                                                                                            SHA-256:49FDD7A5FA81697613F0495EA9E6025FFF84565184A1F3279CA42B166920F1E8
                                                                                                                                                                                            SHA-512:7351B3955F0F881329DCD209841C84A05E0A2C2472FBF1B9F70505D4CE4A6A5FD612D45F3E11E917AB4D086E3B0C1CC7429238EC6DB6DBC879ECD9F3B8340B1F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...E..e...........!.........~............... ...........................................@.............................D....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sw.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.425300372554538
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:CL9FgicgiY7upr4M5aNyb8E9VF6IYinAM+oP91k+DrpIYiF96sAM+o/8E9VF0NyU:QFQ07Gr4M56EpYinAMxwYiJAMxkEUh
                                                                                                                                                                                            MD5:1048D12C5DAA3492E2CC9060BC6AD9C4
                                                                                                                                                                                            SHA1:50051ED23E19D842EB6C9162F537E7C20185ADE3
                                                                                                                                                                                            SHA-256:9123A236243EC5508DB14A4E4E5B2BF3DCA077A6F6A85D24730D0A60A7B10518
                                                                                                                                                                                            SHA-512:F9F6FF586A13CB32281234478A9F7CE2C6222EB94029EBC448815A5083E0303FC7CCA26F03E38575D449E81869817425F9AB2FF321D6A7EA5EE2EB0F99FB6C7F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...E..e...........!......................... ......................................<V....@.............................D....0..(....@...z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ta.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56640
                                                                                                                                                                                            Entropy (8bit):5.625808123733913
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:KmHY51ZLm+4HwpEpYinAMxRBYinyxAMxkEqw:K27Hxb7+xmw
                                                                                                                                                                                            MD5:795ACCE152FDF555FC5F0CBDC21BAC4A
                                                                                                                                                                                            SHA1:B3A5F664D53813E69E33B4AEC327D8121E6066D9
                                                                                                                                                                                            SHA-256:F22F4C4B011B9989D73F0EF16D85F9AA5471CC03394C99FC6D74C401ECA88700
                                                                                                                                                                                            SHA-512:92638A7BD5962C44F3B21864FFBA114EF82B66334735D247B53ECC3A980C1208F597260547A2B9DA938C6D9D9BEF37AE94D5F6AF0683E0D551E6285D7FAE5769
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...F..e...........!......................... ............................................@.............................D....0..(....@...}..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....}...@...~..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_te.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):56128
                                                                                                                                                                                            Entropy (8bit):5.591538654163846
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:aVo3N5ya+LDQEpYinAMx7i+HCYi0GzCAMxkEX:aVo3Ip7HxI70LxD
                                                                                                                                                                                            MD5:CB8793AEC04A19877FA3702EDA7C9416
                                                                                                                                                                                            SHA1:7771A48AFE1B50C03BAE7D98090929753177C9DE
                                                                                                                                                                                            SHA-256:FA58B434E5253B28091CE425EC9296E499241CFC24992E1592154FD1EC449819
                                                                                                                                                                                            SHA-512:577EE217E15379E1523FA72FD995E450FE7DAD262E299B594CDC6A8455DCD5002454B84695BCB3B3370DFB03C0B540B931FFF2C43AC50311FB5E95CD9A76219F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...F..e...........!......................... ............................................@.............................D....0..(....@...z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_th.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):53568
                                                                                                                                                                                            Entropy (8bit):5.6119616279583715
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:TjlrGszNMfetNgEpYinAMxwKYi6AMxkEyI:TjlrGs+fetn7Hx774xWI
                                                                                                                                                                                            MD5:36FF03BB1A029CF62E2FBC0112AB1E1C
                                                                                                                                                                                            SHA1:C6BF4C0E47941019999722F1E57346498AF0A79A
                                                                                                                                                                                            SHA-256:0F6B55613060D527AE41D5BCF5F34F50BD668BA57F9D4D2521EE7DAB2D053C02
                                                                                                                                                                                            SHA-512:08AF745E330ABD384BF06468A2C1A7F6221B0A6C1A9452031FCB4076959C51EB912269EFF77E71F55BFB41C2BE1967A9373B224522ADF856E07B48593E68A92E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...F..e...........!.........z............... ............................................@.............................D....0..(....@...p..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_tr.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.448739449189127
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:Jip9ABk6qXQEdmvgh3FGk+G9Ahrx++BzQSX/EpYinAMxlDCYiZ+mAMxkEPo:JiZhdmvMFGkSxLQK47Hxg7Zxx0
                                                                                                                                                                                            MD5:96C569C1FF875B897A2EBDDD3BCEE40B
                                                                                                                                                                                            SHA1:44F8019C435ECBC1B00E8F1223ECE6C42F1E9976
                                                                                                                                                                                            SHA-256:9682AF6D55EB930C650D69D7ECD4A6101681425F4821333C4513916AE57CC14D
                                                                                                                                                                                            SHA-512:4E6521B28184AB8D09D45FD30E96F3703ADE7F495211380DB0BA79F0372CD834861165B9D66D8CDD0A036850C9866203A6EE60642B80DB4F89D7037BA56C8BC2
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...G..e...........!.........~............... ......................................$.....@.............................D....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_uk.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54592
                                                                                                                                                                                            Entropy (8bit):5.574026643245629
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:QxZMuKgHWyC2EeovVHE/GfuQNyb8E9VF6IYinAM+oP9+Z9BIYiF90+1AM+o/8E92:UMu2uoEpYinAMxkWYixAMxkEw
                                                                                                                                                                                            MD5:BB5F78643FDFBB3600ABB2D4529D857B
                                                                                                                                                                                            SHA1:95F987F0237584B8428470EF8A34774CB18E83DE
                                                                                                                                                                                            SHA-256:2D701243EFCC415F101A68D9A80BD1F93718DF906C5A9DF94B7C7210A72EEFA4
                                                                                                                                                                                            SHA-512:98A80DC74B3A7FAA06401299E2260D6E5801F30C0066F6F4F3BE0B66D432E36FB72044038B839019B0EC37FB8B7317046DD69E74F2E97A7C3CA1DB277891345F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...G..e...........!.........~............... ......................................@.....@.............................D....0..(....@.. t..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... t...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ur.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.583323336112305
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:avoo+OmAcoWACeesYQEpYinAMxYn/YiGAMxkEj:am7HxG70x3
                                                                                                                                                                                            MD5:0E98103A45EBECEDAE05F0EB6BB4AE6B
                                                                                                                                                                                            SHA1:4FD5E0061553B702FC058A1052B6A0CE58F470D7
                                                                                                                                                                                            SHA-256:B5931F32C31EFFB7FC90F95CD27481DB36B6BDB31FBB982CA787794D7E51F892
                                                                                                                                                                                            SHA-512:DC37D909B89017BB2395D8C809D65427AE8C485075FD4D725D3A9BB636A43E0540DA712026CED6BD59BD634743C3A10471D2D7FBBAAF962BAFFFB52DE7F845D6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...G..e...........!.........|............... .......................................'....@.............................D....0..(....@...s..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_vi.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):54080
                                                                                                                                                                                            Entropy (8bit):5.499322127248548
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:ZF7ysKFjncHNyb8E9VF6IYinAM+oP983nX18hIYiF9nX/qAM+o/8E9VF0NynU:LysKVcrEpYinAMxmnzYiKAMxkEG
                                                                                                                                                                                            MD5:7A22F812F92B7F00EF38A14A70BE3F82
                                                                                                                                                                                            SHA1:F1D265A2C835DCDD6225889E895EEDB7094943A2
                                                                                                                                                                                            SHA-256:B3886AF3ABCF6880516189F822DB806524564AAB38F7F9C8AF9052F632BFEA0B
                                                                                                                                                                                            SHA-512:4B82DDE7A1FBC563D7000A034AD943B7AC562CDC8757A70E1899FB418BB7EB3632A6E2BB8227F296DA503EAF16FA3398529CA7781AF606DFC31060E71CF999C5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...H..e...........!.........|............... ......................................x.....@.............................D....0..(....@..Xs..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xs...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_zh-CN.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):48448
                                                                                                                                                                                            Entropy (8bit):5.620247349904402
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:ZAURXZshAWB8Nyb8E9VF6IYinAM+oP9QNA9BPxo0IYiF9YU2AM+o/8E9VF0NyZg:HEAWBcEpYinAMxQYi6AMxkEk
                                                                                                                                                                                            MD5:66B5ABEC8E4B2CABF62B68BD265A48B9
                                                                                                                                                                                            SHA1:5CA58A3B929FC41E617F4CD205317B86E5346642
                                                                                                                                                                                            SHA-256:BBEADD3AF22684259C95C463660AF9C35BA150A00A823B419DF4C633BD1B53CD
                                                                                                                                                                                            SHA-512:F6958C4D687040E17B9A85DC59F26FF2E4B9321D05165946C744F97AB6D29ACFDC8DC531C3B68A25BEFF13BB566D73DC6FD95DA0A292B24F013C0270A27B0137
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...H..e...........!.........f............... ............................................@.............................G....0..(....@...]...........l..@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....]...@...^..................@..@.reloc..$............j..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_zh-TW.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):48448
                                                                                                                                                                                            Entropy (8bit):5.631167984677434
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:ZuHOldGBiuNyb8E9VF6IYinAM+oP9Hs4S4U7IYiF9cO/TqlAM+o/8E9VF0Nyq2:fg5EpYinAMxeEYiV/TqlAMxkE3
                                                                                                                                                                                            MD5:7B02084502F62AB08E9F4DDEE91A3068
                                                                                                                                                                                            SHA1:4588AC3DE96A3DE4E11E0DF0079C58D45208BD8C
                                                                                                                                                                                            SHA-256:8F04BB3D46A4BC4EB58A250296F6B8C97CA37FAC73319D7C7BD8D89CE9AC098B
                                                                                                                                                                                            SHA-512:131FC0928334771CFFEA4CB4AEDF7E993CFEA819E492033601F5025C31C900413E9E534B5982040147B2D4F3EDBB764D588E78EA217DB0CA8C34FA3550EEDD55
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...H..e...........!.........f............... ............................................@.............................G....0..(....@...]...........l..@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....]...@...^..................@..@.reloc..$............j..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):282432
                                                                                                                                                                                            Entropy (8bit):6.580618907494474
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:eRGm4nC4FXoZGxrxAO0e8x5q9Sj/aazvo:eGm4nXFXoZ4qeK5hZo
                                                                                                                                                                                            MD5:B5BDDAF2C405EE17FAF06640D0F27397
                                                                                                                                                                                            SHA1:4FEAD2DC9C066B21C99ACF1646D63A457E5587D0
                                                                                                                                                                                            SHA-256:94B5ADE4D93F125632A7C8DBF79F99DEA877C28C2F40A9CA47C3C660A822CE4F
                                                                                                                                                                                            SHA-512:D620835B8A46E2F0363B2FD1D0A38D58E4BAAA32F1B2DA0F8B9AB8286E031A8B4CA9077C53F88881ED827488C104D1EE099074A2FB7E4A786E8D12901EB4D2BA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............A..A..A...@..A...@}..A...@..A...@..A...@...A...@..A...@..A..Ap..A...@..A...@..A...A..A.`A..A...@..ARich..A........................PE..L...=..e...........!.........................@...............................P......P.....@.........................@X.......X...........h..............@Q... ..T)...G..T....................H.......H..@............@..|............................text............................... ..`.orpc...c....0....... .............. ..`.rdata...,...@......."..............@..@.data....2...p.......P..............@....rsrc....h.......j...j..............@..@.reloc..T)... ...*..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine_64.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):359232
                                                                                                                                                                                            Entropy (8bit):6.269305509202009
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:YgW2y+X80/lGibh/Y7+Vkm5RVsMwbQYohXbBW+15qqpj/aak:/LX8klGibhA7+VlRGbQYobt5/q
                                                                                                                                                                                            MD5:7931008AC869E46D780872FDE1ED4328
                                                                                                                                                                                            SHA1:37B92B318D5252DDC9CAD22BCC37378124BB92CA
                                                                                                                                                                                            SHA-256:971C492072C6E6E6DDB0B8584059E9AF58F3B089DECB151FD860599E818AD1FD
                                                                                                                                                                                            SHA-512:E1A69A6DBF917D336F93783CB60D4D8FE5D7A2A15B2C993AA27A63DD87CFCE235BB4C9D7EC46359BA65C9D610D6CB369EA3BE5058192410C93C36B73B585A579
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2c..S..S..S..c!..S..c!...S...&..S...&..S...&...S..c!..S..c!..S..S...R..z&..S..z&..S..z&..S..S..S..z&..S..Rich.S..........PE..d...B..e.........." .................D....................................................`..........................................\......4]...........h.......%...*..@Q...........1..T....................3..(....2..8...............8............................text............................... ..`.orpc...$........................... ..`.rdata..>...........................@..@.data...LM.......(...\..............@....pdata...%.......&..................@..@_RDATA..............................@..@.rsrc....h.......j..................@..@.reloc..............................@..B........................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine_arm64.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):327488
                                                                                                                                                                                            Entropy (8bit):6.0919814113297415
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:MeyV9fNJmbkqhyVVVz6a+/hRy3LZkMyeRobT28r5RIf7Kj/aaLA:fyDB/IMlG2k5au6
                                                                                                                                                                                            MD5:8A08A9BBC3817967911FAEBB23D3892B
                                                                                                                                                                                            SHA1:41D7426E52AF9E489767A87BCB3B1D0D10992BE3
                                                                                                                                                                                            SHA-256:DF412FE80FB7C2DDA4FC6067641D8A86C53A98C8E8AF2712D657AE8610AE7646
                                                                                                                                                                                            SHA-512:F5C77E3DA56FD9C9171EA04B2F28D20EB1B62EA82AD0CCE371896AF592E7B6023FC478343A4481F1D73678425257AFCE8A8A591F724E90CCB57EB72CEAF0B8DE
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................."......."...n......................."......."...........E...;.......;.......;.Q.......9.....;.......Rich............PE..d...c..e.........." .........(.......q....................................... ............`.........................................0....................h...p..H.......@Q..........p...T.......................(.......8............................................text.............................. ..`.orpc... ........................... ..`.rdata.. D.......F..................@..@.data...,K... ...(..................@....pdata..H....p......................@..@.rsrc....h.......j...0..............@..@.reloc..............................@..B................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):282432
                                                                                                                                                                                            Entropy (8bit):6.580127272835487
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:2RGmVviIKXox+xDvAOlXMx5qNSj/aazvVP:mGmVv3KXoxefX65hZl
                                                                                                                                                                                            MD5:51529BD404AD6A93BACC2FAA88376CA9
                                                                                                                                                                                            SHA1:1891AFC0ADAD2250EB4F36988651039BC975BC52
                                                                                                                                                                                            SHA-256:ABAD43AD3E27D1E6C8611AE285AD1A7C96127DF36B98DC2FE5674B511B62421B
                                                                                                                                                                                            SHA-512:D8F63D61B6BD040FE03A14AE5DBACE73B929E9781EC64A359BF2A832F564DF6D096F0231AB0F408B60C9A6FEA1BD00B15DC0B58152F718C36F3FFA48CF661652
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............A..A..A...@..A...@}..A...@..A...@..A...@...A...@..A...@..A..Ap..A...@..A...@..A...A..A.`A..A...@..ARich..A........................PE..L...F..e...........!.........................@...............................P.......^....@.........................@X.......X...........h..............@Q... ..T)...G..T....................H.......H..@............@..|............................text............................... ..`.orpc...c....0....... .............. ..`.rdata...,...@......."..............@..@.data....2...p.......P..............@....rsrc....h.......j...j..............@..@.reloc..T)... ...*..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser_64.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):359232
                                                                                                                                                                                            Entropy (8bit):6.269345224951521
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:xgW2yufk0/lGibh/Y7+Vkm5RVsMwbQMohQbwfE15qArj/aa/:ObfkklGibhA7+VlRGbQMoJ25z/N
                                                                                                                                                                                            MD5:0259892D2CB710C05CFFCA79F9686FA0
                                                                                                                                                                                            SHA1:185CB66A76CD7B26AD2EAFFF6B1222A7B6C0F309
                                                                                                                                                                                            SHA-256:843DFFA160083155BCC046EBD3C99FA035044156C203A7AE191C629CD83A0EF7
                                                                                                                                                                                            SHA-512:F9A0A25C5D95584055E097593F42FCA04BB4A80BA48A5AC0D592C88273D90896AEB4C975DE72CCB93886209AFFF3F18D771CA7D948AF5BB03B277250D5ED1A97
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2c..S..S..S..c!..S..c!...S...&..S...&..S...&...S..c!..S..c!..S..S...R..z&..S..z&..S..z&..S..S..S..z&..S..Rich.S..........PE..d...K..e.........." .................D....................................................`.........................................p\...... ]...........h.......%...*..@Q...........1..T....................3..(....2..8...............8............................text............................... ..`.orpc...$........................... ..`.rdata..&...........................@..@.data...LM.......(...\..............@....pdata...%.......&..................@..@_RDATA..............................@..@.rsrc....h.......j..................@..@.reloc..............................@..B........................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser_arm64.dll

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):327488
                                                                                                                                                                                            Entropy (8bit):6.091915599984797
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6144:0eyV9fNJmbkqhyVVVz6a+/hRy3LZkMyeHo+TAYr5RIf7Kj/aamO:3yDB/IMlpAw5au/
                                                                                                                                                                                            MD5:8C35995DEDA169AF62A83A5F302C9EB1
                                                                                                                                                                                            SHA1:A45BE3269442DFC9A4D89EFF0003E2292349C2CE
                                                                                                                                                                                            SHA-256:0C5845A003CE6480B24712459725581839E36B00514DA26D4214853107E090D0
                                                                                                                                                                                            SHA-512:2D660FB5CEE6C99E3A6AC54872D0F404E9F7A21B141FBCC067BE40EECDEAE29AC2D1E5141211CFB704EE70BDE40C4D5336E3538F0883143245B90BBBB82F63D8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................."......."...n......................."......."...........E...;.......;.......;.Q.......9.....;.......Rich............PE..d...g..e.........." .........(.......q....................................... ......6.....`.........................................0....................h...p..H.......@Q..........p...T.......................(.......8............................................text.............................. ..`.orpc... ........................... ..`.rdata.. D.......F..................@..@.data...,K... ...(..................@....pdata..H....p......................@..@.rsrc....h.......j...0..............@..@.reloc..............................@..B................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):175424
                                                                                                                                                                                            Entropy (8bit):6.036513000632513
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:cQPidj5By4/EeaZL8Z0BFri9WSfWJVVqH9B+bCe5kNtupnu0D6EDpf34fdjdEcRh:heaCSgfuqdB+i48
                                                                                                                                                                                            MD5:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            SHA1:184A42476F12A89731F608C7198E47BFC35A8364
                                                                                                                                                                                            SHA-256:633B554A26AD05C06DFE33A50F6D69E9160207F3168E15FFD3CB5652B1E8E9D4
                                                                                                                                                                                            SHA-512:DDB593D8A6BC515DCA7A4EADB2F50C28C8E61E9A829186BE9B9E8B19371E969FE055104DEFFD8CD5CD9B48F2468EC8B3D7BF6AEE45079E445D3FE42696E2D5A2
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....A...A...Ao..@...Ao..@2..Ao..@...A..@...A..@...A..@...Ao..@...A...A...Av..@...Av..A...A...A...Av..@...ARich...A........PE..L...)..e.................<...(.......z.......P....@.................................A.....@.................................`q..x.......0............\..@Q...... ....^..T...................@_......X^..@............p..\............................text...4;.......<.................. ..`.data........P.......@..............@....idata..P....p.......J..............@..@.rsrc...0............T..............@..@.reloc.. ............J..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\Download\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\122.1.63.174\brave_installer-x64.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):124775448
                                                                                                                                                                                            Entropy (8bit):7.999996586829686
                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                            SSDEEP:3145728:G7pzQwa6D75W9AobFmNOlpCbLcRLq4vtpN8/RKA/gSBa5:GdzjD7s9FlgsRL9Vo/u5
                                                                                                                                                                                            MD5:40976C35E6CA27871F134A8A2FCAFC21
                                                                                                                                                                                            SHA1:FAA553B01EE47E9079F24A930BCE454BC2D48B37
                                                                                                                                                                                            SHA-256:F5E6C9BA8FB7867D041BC5D7591B50714688FBD31E6716A4D631D549ECEEB03C
                                                                                                                                                                                            SHA-512:4B178177039B894A92E712BFBE7358BB84F2830E8E042B77B3C1864A449F48FAADE7F5F016BC9C03B946BB47AF8389A3DE62C8CC283B9A948021E04338BEBDD6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...(..e.........."......8....o................@............................. p.......p...`..................................................Y..P........go...........o..(....p.(....X..............................PP..@...........0\...............................text...67.......8.................. ..`.rdata..`....P.......<..............@..@.data...p....p.......R..............@....pdata...............T..............@..@.retplne.............X...................rsrc....go......ho..Z..............@..@.reloc..(.....p.......o.............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\CR_CCCBE.tmp\CHROME.PACKED.7Z

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exe
                                                                                                                                                                                            File Type:7-zip archive data, version 0.4
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):123339642
                                                                                                                                                                                            Entropy (8bit):7.999998598936994
                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                            SSDEEP:3145728:c7pzQwa6D75W9AobFmNOlpCbLcRLq4vtpN8/RKA/gSBaE:cdzjD7s9FlgsRL9Vo/uE
                                                                                                                                                                                            MD5:86EFBF7DFA2540421459D8F126B69DFF
                                                                                                                                                                                            SHA1:B2F977F8D49B4B52B9194A21995A72671F428DB0
                                                                                                                                                                                            SHA-256:3CF48645EAE5008E76B836860C0E97BA396393ABB3BF169272A3740644291EA3
                                                                                                                                                                                            SHA-512:1940ED706A6B88C7769B365665DD5DC9405CAD87A9E52A88F85C8F20B41C20453836146D2981DAC547B34B0F66E223161463B14612EA3EECE50BF0D50DB98511
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:7z..'.....%...Z.............,0........8%D...o\3.3A.....B.h4......jh.-.}...XJ...u.../..sA...!k"... D.[p.....'.PV|S.F=..X.1...........?.....].+.xu%3.j..B..r.U.....F..Y.V..D..c!.-/0..x/.........X...d..z.b..$k..Fk.....VU.........l.c...c`\.....*6R.R.W`...nb.hK...(.}.YX...3.Vg. ..P....1.<....9O.?H.ma..H..x...P.>......Ce.....o^F.OE+..\hrc..J%".76..C.3...F0.|..7....4....$fw.j..r..xP....+5.Wi.F..?...rSg.A.L.....X...."...:....X....Vd.....YDvabU;..Y.[f...8...U...g...v..w".Qz..(.u8Z....M.N../..5.C*.7....Y.....:.....hv+...N.4.:....D7..s..S..#....<`u..v..x.S...o..N..r. .C.,E..G....w.qP..Yc....:...o'-h.)....%...H..U......}..1...-$\......../S....~4#..<C...^....9.h.>-Y.......3e-.......38.+`F....Ao...)..y.m.<....l.-..'6=vq.wC.. h9.`......s...V.........J.1g^J.n~......7w...<....a..../..7f..;.-..K.......NQ.......c.[.~.PI......V.A.v.f.@..x..|.1...............n..\...n.Wq9f....3.E....D.*...|..._.H$.df._....J.l;1..;..v9.z......8.Az.J.`.?.u.Z7.S\,}3A9\.Ai..` .

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\CR_CCCBE.tmp\SETUP.EX_

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exe
                                                                                                                                                                                            File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 1398528 bytes, 1 file, at 0x2c "setup.exe", number 1, 106 datablocks, 0x1 compression
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1398528
                                                                                                                                                                                            Entropy (8bit):7.997895296558124
                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                            SSDEEP:24576:Ya8jjP9IJP9Z/SYOSvOI5cWYXQ8GRax5zy3x51HKibc6ipXEnbsZg+SzDE:Ypjr9IJl8cOUc3Q8/zyh5JKib/osbsZL
                                                                                                                                                                                            MD5:4779AEF1A790DC6877982099B73D0830
                                                                                                                                                                                            SHA1:84F3CC4D75FDFA339094C09CC3AAA084B1C58447
                                                                                                                                                                                            SHA-256:2C528B0F11BFE7788F8A95091B9C4E624B4A22173FE1F94DDDBF49B190100C9C
                                                                                                                                                                                            SHA-512:EC6F7287EE608EF832F8AEB331584FC3C6DF0C9D257DD324485DD6FE4274F9AB5129181787535D890584D5EAA38741A1E64F4E0DA52098D957185A37A2386B9E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MSCF.....W......,...................F...j.....4.......mX,C..setup.exe.....j...CK.].P.W..!.N..7X..q..l.u..-w...u.......I....V*.4..;......J...n....ck/u.....s...b..h~h..u........}..u.o..F...~..u.{....y...~.%.m.L.$.........e.y/C.y..Gw.J.=Z....V]...q...vy<Z.m..[.F...cs,..m.V.f.,I..$.rK.d......+.w...2$i.]..=....$......4IJ.D..%....?...J.m..]..>..\.i.7`_O......T.|B.&..o-..!....T..$.o.r....W..J......vM.._o.k.yuk6.a....."...A.y5..:.$)Wqr......#.C....e.....;.'I_..{.....r...4...y.....E.9...y..}._}"...5u.n..*h...I.E^....x..qp..=.....u.Z.. [......ZTZ..Z>.\....%..EE..L*.2...vW.....P.VP.....S...w......PA.~.gq....Y.<...%..{_\..>.s..&}....D_.Si....g..K......l%[..+.+...m........`R.6[e..NQ..O...O%.y....CIY.([Y]nWV/.C!..LC.lSY.y....U..Ue.S...S..'g)..7._......{...l.hSY...I.l./.B..M..B.A...D.W!...2...).B2.O2..2......E..des.-Q"j.Q#..#B.uG.Q.'uy..<...{Yc.....z...0.........X..D.l........D.N...N\......H...#..=....i....8~...'@..;...;..]a.. A...D...3HL..,p....|.....

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\CR_CCCBE.tmp\setup.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):3458072
                                                                                                                                                                                            Entropy (8bit):6.570710999931397
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:49152:6rExC6sQI1X3DuLCyJ6kLi7XssLIkmMgtfhXbcszPMuX:Z6ke7csgP
                                                                                                                                                                                            MD5:41F40C4225A40DC6DA684E5F40CAABF2
                                                                                                                                                                                            SHA1:25F509B439071AABBFADB37D74FF20D8FAE5AC32
                                                                                                                                                                                            SHA-256:0AF286D49A182A01201C6AFC9154520D85499301DB2172C47FEF7FDAD6EF7514
                                                                                                                                                                                            SHA-512:5810B523F14FE12EF0A62F580D0CDA7326175585D31052A8A666FB1FD31D490249ECB5E65A388DE5C813BC90BF2A9EA40DAE0C337291FFA0F62F55DA216E1E4B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...(..e..........".......(.........p..........@..............................6.....9s5...`.........................................#.,.N...q.,.|....@1......`/.......4..(....5.T%..|u,.....................Pt,.(...P.(.@.............,.......,.@....................text....(.......(................. ..`.rdata..H.....(.......(.............@..@.data.........-......|-.............@....pdata.......`/......r..............@..@.gxfg...`1....0..2..../.............@..@.retplne......0......./..................rodata.......0......./............. ..`.tls..........0......./.............@...CPADinfo8.....0......./.............@...LZMADEC.......1......./............. ..`_RDATA..\.... 1......./.............@..@malloc_h.....01......./............. ..`.rsrc........@1......./.............@..@.reloc..T%....5..&...v4.............@..B........................................................

                                                                                                                                                                                            C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exe

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):124775448
                                                                                                                                                                                            Entropy (8bit):7.999996586829686
                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                            SSDEEP:3145728:G7pzQwa6D75W9AobFmNOlpCbLcRLq4vtpN8/RKA/gSBa5:GdzjD7s9FlgsRL9Vo/u5
                                                                                                                                                                                            MD5:40976C35E6CA27871F134A8A2FCAFC21
                                                                                                                                                                                            SHA1:FAA553B01EE47E9079F24A930BCE454BC2D48B37
                                                                                                                                                                                            SHA-256:F5E6C9BA8FB7867D041BC5D7591B50714688FBD31E6716A4D631D549ECEEB03C
                                                                                                                                                                                            SHA-512:4B178177039B894A92E712BFBE7358BB84F2830E8E042B77B3C1864A449F48FAADE7F5F016BC9C03B946BB47AF8389A3DE62C8CC283B9A948021E04338BEBDD6
                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...(..e.........."......8....o................@............................. p.......p...`..................................................Y..P........go...........o..(....p.(....X..............................PP..@...........0\...............................text...67.......8.................. ..`.rdata..`....P.......<..............@..@.data...p....p.......R..............@....pdata...............T..............@..@.retplne.............X...................rsrc....go......ho..Z..............@..@.reloc..(.....p.......o.............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1310720
                                                                                                                                                                                            Entropy (8bit):1.352856693117131
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrk:KooCEYhgYEL0In
                                                                                                                                                                                            MD5:8E43CFCF9D9D46068A4D4EF9EC1CAB96
                                                                                                                                                                                            SHA1:3527557F92A4462155F0E3B4144413D2FB6665CE
                                                                                                                                                                                            SHA-256:24595761E9A7B289C1379FB06B6585DE8FD64B819523BD30B62FE475EDF0C7A6
                                                                                                                                                                                            SHA-512:C29459F9018D1BC3CC2ECC1FC1C13A062F5EADED38C484BBBDCF5F42458CC845133BC63DA042D49D619D82EED717659D708DE40769D83C107DE89DD756D1454B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                            File Type:Extensible storage engine DataBase, version 0x620, checksum 0xe0e9af6c, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1310720
                                                                                                                                                                                            Entropy (8bit):0.42217067246711193
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
                                                                                                                                                                                            MD5:893EB460315C54CF37C8F97567298F71
                                                                                                                                                                                            SHA1:FDC77C5928F9BC52532D0703356181E73DEE244D
                                                                                                                                                                                            SHA-256:0E78E8649FB606C0A8F7B4DB84CEC5009C7F4E12CEDE38133325C17DB46A06AF
                                                                                                                                                                                            SHA-512:B9690FE66DBCC15FF5AAD4D95D5DDAA7E250184D8A0D66E5807EBA90B7A050BE28FE2D161A94623F83EDCEF81333609FCC95F913B1573BF1CBD08038C1DB3287
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:..l... .......A.......X\...;...{......................0.!..........{A.%....|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................+..m%....|......................%....|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                            File Type:OpenPGP Public Key
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                            Entropy (8bit):0.07711469264046628
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:nSltKYe3Imq+CCjn13a/V1Tl1ollcVO/lnlZMxZNQl:nWtKz3xx53qEOewk
                                                                                                                                                                                            MD5:2908DD4F6E9B13D141C4126799F7CC97
                                                                                                                                                                                            SHA1:E77CF0F8BA94EB256568DAA82AF565EE882CCB1F
                                                                                                                                                                                            SHA-256:41982661AEE79EDCD0E66EC85249130A901AA4884AA622C2B2C7D1FE428F3F26
                                                                                                                                                                                            SHA-512:A59B0A59F8E1B4A516B701061090F8B8B7389987B15C9F93B5AC6BB512F5053CAA8D459A8E5EE3FF50027C30ACC98A168672BE5A741EB5D9891B41DCEB0F5548
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.."......................................;...{..%....|.......{A..............{A......{A..........{A]....................%....|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\HF00MDDL\www.msn[1].xml

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):127
                                                                                                                                                                                            Entropy (8bit):4.9950799907452375
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:D9yRtFwsSxzqC+eAsEVStKVHFk6tzXafHa9qTViSlmKb:JUF+FqCqRStME6o5b
                                                                                                                                                                                            MD5:43B73CC1E175FA7258DB2398ADA5C65C
                                                                                                                                                                                            SHA1:A2DF6B4BA820A33D4FE5737540B6E722A9638A65
                                                                                                                                                                                            SHA-256:C25976FCB95979FF267BCB3F85BFA8715F18F09FDDE394199B01BFCF844F97B6
                                                                                                                                                                                            SHA-512:6E5AAE836279FB145645DD4CCB439B59AB490B62937A02660E8E310EECCE9B5B89AFF4460496D0176185F4BECE56D0679C942F869C6474258819F018E6E3B870
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<root><item name="pageVersions" value="{&quot;hp&quot;:&quot;20240308.207&quot;}" ltime="1157623888" htime="31094247" /></root>

                                                                                                                                                                                            C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):4286
                                                                                                                                                                                            Entropy (8bit):3.8046022951415335
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
                                                                                                                                                                                            MD5:DA597791BE3B6E732F0BC8B20E38EE62
                                                                                                                                                                                            SHA1:1125C45D285C360542027D7554A5C442288974DE
                                                                                                                                                                                            SHA-256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
                                                                                                                                                                                            SHA-512:D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0fc9f826-512a-49c3-9306-754579904869.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):31003
                                                                                                                                                                                            Entropy (8bit):6.065768163736578
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:3F5kruq4eVbAXbU0+JqK5NAz3jeMQWonubZpG2B:3Fmi3bXYfAzCwBZpBB
                                                                                                                                                                                            MD5:57813E91BB4BB73977F362BD4B2A34E7
                                                                                                                                                                                            SHA1:A6ED02FDCF69A1E21CF42DD02A645958ECD4CC85
                                                                                                                                                                                            SHA-256:54D435C1EC4BFB0294D99A99CC55627AE139484F2F9943E1403821E4CED51251
                                                                                                                                                                                            SHA-512:95F2DFBE74AA7480354EC61D2EE3AF89629FA28A5B49E78D059F20C481331FB9FCD77CDEB50CCD368E49E5961EF98EC687E165B9F6A58EC4A88766099D5A34E6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354877499479783","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\29753ff1-336c-49c0-999e-3174064518d7.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:modified
                                                                                                                                                                                            Size (bytes):68178
                                                                                                                                                                                            Entropy (8bit):6.079503986964956
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:3Fmi3bXYpyXInwT4XuJUHhQzsWwXk+sJXAzuwBZpBB:Mi3bXYYXInL+wZW5+sXAzuaZB
                                                                                                                                                                                            MD5:C798CD076437D59027B04B8921779963
                                                                                                                                                                                            SHA1:38A5076E7F19A2567E54552AE204E01712C1CAFE
                                                                                                                                                                                            SHA-256:C537C3A320AED481B51E1B2D78F0C79BDD9155EFEFFBB6BDAF34AB5EBE236F81
                                                                                                                                                                                            SHA-512:6A633A2B45EDD2F2D9823CDC49064177042AA33301665A80BC8BE31318A7CC17556E69C5779DD6CB4B535EE5257B73D4CFBE18F7E8453D107E87485C1C4C5588
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354877499479783","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2e68bc1a-3e00-4537-96b8-b9bc34615c71.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8243
                                                                                                                                                                                            Entropy (8bit):5.797647727641853
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:fsNAg2cYeiRU/hQLkKW+iv6qRAq1k8SPxVLZ7VTiQ:fsNAfU+IK46q3QxVNZTiQ
                                                                                                                                                                                            MD5:B56BCFFDEB6B1DB94EAAE3A8F9221C46
                                                                                                                                                                                            SHA1:B4300E6FA939AA4B553C226C0C3165020140AECD
                                                                                                                                                                                            SHA-256:06EB73A1FC900B9381B0F0A72DE417F29D72DFD03FE1BD809FBD5D9934BA6E23
                                                                                                                                                                                            SHA-512:845DDA0202CECF68558F9A202421A2D07C316CB9AB44EFBBFDA820569D8247527CDF98421509FA6552BB614784C7D9614675615B18D933FACC27329DEA602CD0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\32e9070c-dc04-44a7-b5e7-9da2b302e42a.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8325
                                                                                                                                                                                            Entropy (8bit):5.791560451849757
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:fsNwg2cYeiRU6hQLkKW+iv6qRAq1k8SPxVLZ7VTiQ:fsNwf3+IK46q3QxVNZTiQ
                                                                                                                                                                                            MD5:09058C1CA538408094A3DB2D584440D1
                                                                                                                                                                                            SHA1:6198BD208C4004538B73911DB45217C4ACECB406
                                                                                                                                                                                            SHA-256:53C62384A69C4ADCFFE34B0394B136162F551237675F75B1D0F02D490B0C8DEE
                                                                                                                                                                                            SHA-512:E5116A14D9E493344110946C367E15B32CC322F0D88C4607531F6E44AD0986A43BEFFC3FEECD67A8A6F8858D4876E1870F364263DD0C0A1BE1FD63B966D70EED
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4cfa11da-8cf6-4dd7-a0f1-6997d4d1e8b6.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):27124
                                                                                                                                                                                            Entropy (8bit):6.072679163253485
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:3F5kruq4eVbAXbUy+I9QKsXeMQWonubZpG2e:3Fmi3bXYVOwBZpBe
                                                                                                                                                                                            MD5:3804C36CF780F58492AC26F77C9013F2
                                                                                                                                                                                            SHA1:F9917EA45783B564E3FBEF1C3396D16C9C30A55E
                                                                                                                                                                                            SHA-256:FE12F5E024DCE7E9079699781A6E1077C721FB7124D6C1294F000CB74EC88247
                                                                                                                                                                                            SHA-512:9B8411D7BC7CEAC191A19A28FDE215AD2C7726D63DF473E4CBEAA1873B6297783DDE950C82B52246645569E537096FE0EDE30B4CFE4CD74D540ED846D43B62AB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354877499479783","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\740b10f0-aa3a-430c-bb3b-fcea136148e6.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):7559
                                                                                                                                                                                            Entropy (8bit):5.584608775261925
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:b4qsNk/bqlfIFUmZv5ih/cIyURLl8RototrBHUVvliZQqe4WJkKcH+TeKbaMjVxx:3sNwu62cYViRU0LQLkKW+i/M7f5
                                                                                                                                                                                            MD5:9B281B0375880E8ECA1ECC08349ABD7E
                                                                                                                                                                                            SHA1:1BC52799A9773ED884DCBBEC3AEA1E61FD25824C
                                                                                                                                                                                            SHA-256:D4BD59A2782667AEABFB4E7C91F69AE0A21A7D5BFA5B0AC92E9E918E9EA684A5
                                                                                                                                                                                            SHA-512:7764582054A0442294B6E887A018857BCD9308371C3EF243A3EC66A5315A7EAB8C3DAD71CF410C95F001FD0B4C0C3C03EE0123AF929519581BE00CB5AA72E511
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"apps_count_check_time":"13354877499479783","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"host_package_checked_on_browser_version":"117.0

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\74effe42-bc28-42b5-8203-d5645af35a72.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:modified
                                                                                                                                                                                            Size (bytes):27124
                                                                                                                                                                                            Entropy (8bit):6.07266620090743
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:3F5kruq4eVbAXbUy+IjjKsXeMQWonubZpG2e:3Fmi3bXY4OwBZpBe
                                                                                                                                                                                            MD5:7651AC022F67907DDC9499D65378E811
                                                                                                                                                                                            SHA1:5C2D555042DF3122F75880CD895E6F69DFB4E391
                                                                                                                                                                                            SHA-256:57D3B473202618E6E0BFEA9DE347CCA99C8558FB672CD6F5259E17B71CF9B885
                                                                                                                                                                                            SHA-512:83DEF6D86B20FB5A42688C0942F15EE2E49B2681CC77774129ECE1A67737566E2DE793F43B8C8135569504FF18F44FD2477EF0D72927B91C1A1FEEBBADFE4CCF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354877499479783","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\79976c4a-7d09-4387-ad09-57e509d4d0fc.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):26094
                                                                                                                                                                                            Entropy (8bit):6.070656181654293
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:3F5kruq4eVbAXbUy++IKEeMQWonubZpG2B:3Fmi3bXYCwBZpBB
                                                                                                                                                                                            MD5:C3056B837D0630B532AE479088779F78
                                                                                                                                                                                            SHA1:51C1279796C63E0B2F0C1173DDED0A8000C0C7E0
                                                                                                                                                                                            SHA-256:685EA42A571D82AC7930FE2B91ED51FD1907E6B4DB26684CA05C9B956755C7E2
                                                                                                                                                                                            SHA-512:D7EC2C8F4F04A366B430481F8A9A2BEA209AA68237664B3243C39D08D49E8178DCE00036DA26699EB945D1E0E904019F744E80DCADAE10E94B2B07C75F7D082C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354877499479783","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\1e83fe6e-0a03-44ca-8f90-212335b91eb3.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):101961
                                                                                                                                                                                            Entropy (8bit):4.633247394116942
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:W/lv4EskMNTQps5Vdw34PsiaM++tDulXridW+LuhVrL:+wRQO5VdwIT+S8GdZKVrL
                                                                                                                                                                                            MD5:8D94C8CCF0C8BCEC6BB57C7A35780F9A
                                                                                                                                                                                            SHA1:9BAE04B1199BE76C68B6C0092431C006A9D0B2EE
                                                                                                                                                                                            SHA-256:3C65E92F6827627CE1AEC0B03BDA3853E5130D6D4A606A295ECC03724B321359
                                                                                                                                                                                            SHA-512:1BEDB6D3588E7ECB118FC79D5CDDD454B044250F6FD7F5F56330D0B24FBBCFB712FFA3F1BA6A3B62E8B8157A32CC2F5483C3CF3EB88766877711E445B5CBB8DB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):101961
                                                                                                                                                                                            Entropy (8bit):4.633247394116942
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:W/lv4EskMNTQps5Vdw34PsiaM++tDulXridW+LuhVrL:+wRQO5VdwIT+S8GdZKVrL
                                                                                                                                                                                            MD5:8D94C8CCF0C8BCEC6BB57C7A35780F9A
                                                                                                                                                                                            SHA1:9BAE04B1199BE76C68B6C0092431C006A9D0B2EE
                                                                                                                                                                                            SHA-256:3C65E92F6827627CE1AEC0B03BDA3853E5130D6D4A606A295ECC03724B321359
                                                                                                                                                                                            SHA-512:1BEDB6D3588E7ECB118FC79D5CDDD454B044250F6FD7F5F56330D0B24FBBCFB712FFA3F1BA6A3B62E8B8157A32CC2F5483C3CF3EB88766877711E445B5CBB8DB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):4194304
                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3::
                                                                                                                                                                                            MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                                                                                                                            SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                                                                                                                            SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                                                                                                                            SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):4194304
                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3::
                                                                                                                                                                                            MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                                                                                                                            SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                                                                                                                            SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                                                                                                                            SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65F2B13A-1C78.pma

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):4194304
                                                                                                                                                                                            Entropy (8bit):0.34614383036987467
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:oroLtfC3JgmsmI0NH3JMTbdozdLk5SyJJ2mO0oFmqL06H777nfu+KQcL5s+NQ30d:/yNXddLuJJ8PiyNjgxaHuEOTP
                                                                                                                                                                                            MD5:A5E9805135C6B128F6BBDA61E75D2327
                                                                                                                                                                                            SHA1:0A6AB2EDD2686230A6BDEEB5D0521CBB8630AD7D
                                                                                                                                                                                            SHA-256:DC02353FDFE35335A87934EA7F35638691B48406C561854D6CFDEFF3BAD49275
                                                                                                                                                                                            SHA-512:8CC4995A957215FB618230177DDAAFD3C92CE673A84FE6D904EEB7BE40306A03CCF380351BA5C24DD4C4219A2FB9C9E9172FB901EBE6FD6F2DE4E1AE7FC97B3B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:...@..@...@.....C.].....@...............8...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".frblgy20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...b.J.^o..J...#...^o..J....k..^o..J..?....^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J....%.^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J.......^o..J...'x#.^o..J......^o..J....\.^o.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65F2B150-233C.pma

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):4194304
                                                                                                                                                                                            Entropy (8bit):0.04073041408198366
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:bq0EbtmqvDtKX7XJEa3XxxTxqZ/g+Xq970R6EqhTS7Non71gQM+U0mn8y08Tcm2D:+0EtseK8YDFhIshgiUh08T2RGOD
                                                                                                                                                                                            MD5:28B30F9C2D7617244327729CFE0273B0
                                                                                                                                                                                            SHA1:C61948008CE543791A7238C6D527689402B4E1B3
                                                                                                                                                                                            SHA-256:24E9EF829CD680DE23A23A03428DE2CD80190C1F003E122840677E7B3AAC9CE3
                                                                                                                                                                                            SHA-512:4D108BA0436DF931168B06A0EA4406D28A5ED8BDCC6822B7B18C4F1C8590EC6C75AF41F9108DA2A3CB8258D1069439386322E0F84459F39C6F7F48A73788EA62
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:...@..@...@.....C.].....@................b...Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".frblgy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65F2B158-1B6C.pma

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):4194304
                                                                                                                                                                                            Entropy (8bit):0.03986022093761555
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:/e0EbtmqvD3KX7sJEa3Xxx7uqZGXPtg34khhhBNE6nrm1gQMVNogn8y08Tcm2RGY:20Etle18xphBxGgZNF08T2RGOD
                                                                                                                                                                                            MD5:FA502819E90CB4F9E16F03E87A06DFCB
                                                                                                                                                                                            SHA1:EEB6740F7CDAF0ED8AA7DFA902FC1D1BFB8463BA
                                                                                                                                                                                            SHA-256:FDD74F664013E8F10D823AEA182C04F881786F3B939638078481E522E9936926
                                                                                                                                                                                            SHA-512:8F3B2E180F9DDED405B4B3E93D2F4932AF6AAF4CD537F7E68ECAF223D82EBD5B1EABF9C4C78B488220A88322A4509754F3AC3CF126D303C2CFF3681FFA18185D
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:...@..@...@.....C.].....@................`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".frblgy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                            Entropy (8bit):0.3553968406659012
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
                                                                                                                                                                                            MD5:CFAB81B800EDABACBF6CB61AA78D5258
                                                                                                                                                                                            SHA1:2730D4DA1BE7238D701DC84EB708A064B8D1CF27
                                                                                                                                                                                            SHA-256:452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
                                                                                                                                                                                            SHA-512:EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):280
                                                                                                                                                                                            Entropy (8bit):3.053837919135487
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1Qllt:o1//BVsJDG2Yqc/
                                                                                                                                                                                            MD5:2DE758B44E33AEAF19BAF23B60AA10AD
                                                                                                                                                                                            SHA1:CC987BEF7CAFDF20BC38906BA55767454B029A6A
                                                                                                                                                                                            SHA-256:6E8D74D84A400AD5C68229CF1458EA52EE75018E74070152DA8A189853FBF2C6
                                                                                                                                                                                            SHA-512:6BFC85466FC55782132F38EB3F851FA80434494A2A1607862607065608CE11C2CFA2533C218165F869BC41B5790C6E58F8A8FBCFBFCF59623C3B90436AFD37D0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0dab0e6b-7e69-4610-8f63-9bd6ff63a01e.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8567
                                                                                                                                                                                            Entropy (8bit):5.071805730945885
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:sV7ql5J1VoXb9JvTdbreXK6xBAYksY5Th6Cp9/x+6M8muecmAeCQe4zvry2X6gEf:sV7SJs3bdveRBAYksYPpj+FVAayFBf
                                                                                                                                                                                            MD5:4802A02A49BFD7BA6DB635DFA823ED38
                                                                                                                                                                                            SHA1:94574CC6E2ED1EC2F5D3416B78F458CF36EF29C8
                                                                                                                                                                                            SHA-256:3D0EDEC564D11E9117EA8E840E451E403F66A1E3F5851F7E0F3322F5991CA66F
                                                                                                                                                                                            SHA-512:D39A09179231617546D82311B461300DAA22877CE7C74026BCD675FAC199147DFE976D1CDDDDB244F498D6932E4D25E2577BAA7CB8EDBB34CBB8D8B9B1E67746
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354877499400966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0e098fa3-7019-45cf-84f1-b98d4f0c8c06.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):9222
                                                                                                                                                                                            Entropy (8bit):5.185144488356635
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:sV7SJs3bdveRBHsmqYksYPpj+FVAxyFBf:sV7SJmJvUBHSpUV06
                                                                                                                                                                                            MD5:BAB99143E5A1CFF1BE5AD1769B84118C
                                                                                                                                                                                            SHA1:EB77369C6EB47CF311DF28351FE3850A99DE6CB7
                                                                                                                                                                                            SHA-256:4EDFDCE357FCB330FF04CED0F48D8A55EE3E5D70949D855162CAE38ED1C0CF27
                                                                                                                                                                                            SHA-512:22D650AFAA2CD8AAAF02ADF6F64A370718AB79FE2F35F0C0DA6170E00CF959FC479300A72967D20808A148246D182E0958958DF044A677E41E82FFBC14BE2FFF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354877499400966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\17fdda61-283e-4ccb-9774-0d6737d89efa.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):7726
                                                                                                                                                                                            Entropy (8bit):4.915233456906699
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:sVzql5J1VoXb9JvTdbrNYkedY5Th6Cp9/x+6M8muecmAeCQe4zvry2X6gS5AtEHb:sVzSJs3bdvNYkAYPpj+FVAayFJf
                                                                                                                                                                                            MD5:53FE659F3C98304004DBDA6CBB70DEA1
                                                                                                                                                                                            SHA1:7879BAD2FE022D68BDB6E1319C9075E84CE8FCB5
                                                                                                                                                                                            SHA-256:E285A7CEF11E92FE17E38F8FF679712BD5B53637C2CF80168EDEA989F00EEAC9
                                                                                                                                                                                            SHA-512:CB53858986463EAB7D59CAC9A7619ECE014321FC94ED60CF6782F790A037B4E6C23C52B093D4A6C7EBA6C37949F80CEC89EB78B3041520623D9B00FE538DAFBA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354877499400966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\21642b63-012d-4819-9de0-db230342b1c3.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):25012
                                                                                                                                                                                            Entropy (8bit):5.568210220440691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:REWovRWPSofrq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxYdeMrwBbxpdtum:REWovRWPSofrqu1ja0OelNltJ
                                                                                                                                                                                            MD5:1D2FF791DE2DADB418DE35D9D09E8C96
                                                                                                                                                                                            SHA1:7B1F7C210501536CEFDDA42F2FF37D5C39CE39BF
                                                                                                                                                                                            SHA-256:FA3A80E01165A7439DC4CF54500665E9CF18A26F6EA83B2A144BE0788932B0D9
                                                                                                                                                                                            SHA-512:475014F630C0352EBDE2703A6D579D3B649D1E15CD19C2F8C9DF355DAA634E57F221B81FA55F2790EE3126C6EEF0CAF52A3418336CC7D879C3BB656AB6DBFED1
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13354877498968934","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13354877498968934","location":5,"ma

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\274cf2a9-5f37-4f2c-bf3c-53341eedbf6d.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):9331
                                                                                                                                                                                            Entropy (8bit):5.183034495409715
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:sV7SJs3bdveRBHsmqYksYPpj+FVAOyFBf:sV7SJmJvUBHSpUVN6
                                                                                                                                                                                            MD5:8C380A85D5C8F4BEA414D3A2A983A81B
                                                                                                                                                                                            SHA1:A639B03C3C95B508454F7FA4ED8DF5159EAD15D1
                                                                                                                                                                                            SHA-256:11D2D949AFB4E1243175923975023E9E1ECA737D10E5A3AE8A4EF09656AA0812
                                                                                                                                                                                            SHA-512:6292AEA7714B9A6B6474DDDD195A402C59913BC20AA1FB56F08F029EBE02CD564B8E09C99DE598E644407267EC3D67AC54689D81A22AB2B8AAF056F52FC38A44
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354877499400966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3f9a4430-1eac-4e42-8605-3972090b4af4.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:very short file (no magic)
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1
                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:L:L
                                                                                                                                                                                            MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                            SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                            SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                            SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\759587cb-d627-43e5-b001-80c6d2b64e25.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):9294
                                                                                                                                                                                            Entropy (8bit):5.184755266713031
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:sV7SJs3bdveRBHsmqYksYPpj+FVAByFBf:sV7SJmJvUBHSpUVM6
                                                                                                                                                                                            MD5:F3C25CDE91ED7FA501B5277D8739FA65
                                                                                                                                                                                            SHA1:B9E03750F41311FD59025233C96133F91E2E88A1
                                                                                                                                                                                            SHA-256:43336CE5AED2D5AEC9AD7A245865C26F382A13C346E832181D7114FED56D0C3D
                                                                                                                                                                                            SHA-512:C2485E3344D69711D84F5AF9A235579D3BF3909503248D976EB6B0D143CB990B56D7791C81CD6A7B86D9ABBD33212BCCC8E824A80FFA763AADA7C30D5F77BB42
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354877499400966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\778255b0-f7d8-4379-8022-0fb0cb7672e6.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:very short file (no magic)
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1
                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:L:L
                                                                                                                                                                                            MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                            SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                            SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                            SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:modified
                                                                                                                                                                                            Size (bytes):12735
                                                                                                                                                                                            Entropy (8bit):5.349093451876893
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:71OEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:hOEOKSXs/J7mGnQmLu5/5eNdl
                                                                                                                                                                                            MD5:BDBDEAFF432CFE5B22C554558159118C
                                                                                                                                                                                            SHA1:FF961BE9F033C7577495E63B0685D656907B52E0
                                                                                                                                                                                            SHA-256:934687D59C7E3FF3253CFFB837E8DE4115908623D31FD422C1778C56E293F13B
                                                                                                                                                                                            SHA-512:027F1FF8C00203BB196B257F5E8867C4A205CD5C1A7819C0F46211C2CCB74F02F6132CF44F99645B4BE3AE8046C48F23405E5C41AFBC0D5DD45F3FCBB84088FA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:...m.................DB_VERSION.1.g...................QUERY_TIMESTAMP:arbitration_priority_list4.*.*.13354877511708202.$QUERY:arbitration_priority_list4.*.*..[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=imsWdc2PGC%2BuAreb04yW9xpieA0z5NEov%2BfbkBLqCb8%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-05-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBAT

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):293
                                                                                                                                                                                            Entropy (8bit):5.128444849163793
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEG5ToM1wkn23oH+Tcwt9Eh1ZB2KLlvEGTdaOq2Pwkn23oH+Tcwt9Eh1tIFUv:aGVorfYeb9Eh1ZFLiGRaOvYfYeb9Eh1b
                                                                                                                                                                                            MD5:D8149A3F244635B5205B5D1ABC216BD1
                                                                                                                                                                                            SHA1:FAAA5A066AFCD8C6B411973F33249BFAFB593217
                                                                                                                                                                                            SHA-256:D0340C6AA68D4C43DACF4A34FAE0352639C69604A62E5E826C229D00ACC798A4
                                                                                                                                                                                            SHA-512:FB9CF9B04D8FEBB9A1429C30BD31820A511BD4088D00921562AA461D71168C26A2B2FF4E9326711CE73320C82807E9F2B8FA1C281E6DBECB08AA2C81207A4055
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:50.283 16c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/03/14-09:11:50.983 16c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                            Entropy (8bit):0.3202460253800455
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
                                                                                                                                                                                            MD5:40B18EC43DB334E7B3F6295C7626F28D
                                                                                                                                                                                            SHA1:0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
                                                                                                                                                                                            SHA-256:85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
                                                                                                                                                                                            SHA-512:8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.01057775872642915
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsFl:/F
                                                                                                                                                                                            MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                            SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                            SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                            SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                            Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                            MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                            SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                            SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                            SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.011852361981932763
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                            MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                            SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                            SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                            SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.012340643231932763
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                            MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                            SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                            SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                            SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):262512
                                                                                                                                                                                            Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:LsNl6ol/:Ls364
                                                                                                                                                                                            MD5:E632948B1510826254AD9F8A2E34573E
                                                                                                                                                                                            SHA1:043713EC478FF326CA731B8DB650A0714451F727
                                                                                                                                                                                            SHA-256:5E19CD758D6CA7A2F02782C0E0818028CE41D5A549E0E40D0F670DB4DA2EB661
                                                                                                                                                                                            SHA-512:8FC9F912BCD3562EE9F27AEB8824A0DE86BC1F7F1216CE43461134D33A3D0FC7778202CB60352C939779EBFA21D3DC5DA289DA62BE83CE7D60EE7F3FF0B82180
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................?z].0r/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):33
                                                                                                                                                                                            Entropy (8bit):3.5394429593752084
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:iWstvhYNrkUn:iptAd
                                                                                                                                                                                            MD5:F27314DD366903BBC6141EAE524B0FDE
                                                                                                                                                                                            SHA1:4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
                                                                                                                                                                                            SHA-256:68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
                                                                                                                                                                                            SHA-512:07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:...m.................DB_VERSION.1

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):305
                                                                                                                                                                                            Entropy (8bit):5.188131128247825
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEG5vUgV81wkn23oH+TcwtnG2tbB2KLlvEGJR+q2Pwkn23oH+TcwtnG2tMsIFUv:aG5MgVbfYebn9VFLiGL+vYfYebn9GFUv
                                                                                                                                                                                            MD5:C489AEDE44D153E842D27942C83ACC1D
                                                                                                                                                                                            SHA1:9EA93B054FBB4326D42ED2C56295C39C0B4D1FC7
                                                                                                                                                                                            SHA-256:7571E7F91A130BC14041B6500E6FBE33D9F35E11D57AF1518CA8B895A80ADFCE
                                                                                                                                                                                            SHA-512:3A4CA18D86AB8C00443DD05C3AA7AA08EEB607AB83102545F654BC9A675994AA1F1B6762AEA9DDC62A8DE0B117066A54CA8F92B6370BD542C69DF7834456CFDC
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:38.982 1d3c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/03/14-09:11:39.032 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                            Entropy (8bit):0.494709561094235
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
                                                                                                                                                                                            MD5:CF7760533536E2AF66EA68BC3561B74D
                                                                                                                                                                                            SHA1:E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
                                                                                                                                                                                            SHA-256:E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
                                                                                                                                                                                            SHA-512:38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                            Entropy (8bit):0.5094712832659277
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
                                                                                                                                                                                            MD5:D4971855DD087E30FC14DF1535B556B9
                                                                                                                                                                                            SHA1:9E00DEFC7E54C75163273184837B9D0263AA528C
                                                                                                                                                                                            SHA-256:EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
                                                                                                                                                                                            SHA-512:ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):209
                                                                                                                                                                                            Entropy (8bit):1.8784775129881184
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
                                                                                                                                                                                            MD5:478D49D9CCB25AC14589F834EA70FB9E
                                                                                                                                                                                            SHA1:5D30E87D66E279F8815AFFE4C691AAF1D577A21E
                                                                                                                                                                                            SHA-256:BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
                                                                                                                                                                                            SHA-512:FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):281
                                                                                                                                                                                            Entropy (8bit):5.186578366937
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEG5hfD1wkn23oH+Tcwt8aVdg2KLlvEG5GBH39+q2Pwkn23oH+Tcwt8aPrqIFUv:aG5kfYeb0LiGUIvYfYebL3FUv
                                                                                                                                                                                            MD5:929B20D0DE1F5E49C6B23A06F2CF4665
                                                                                                                                                                                            SHA1:DF4D0D9490CE16B302AF65BFFD460F770411FD92
                                                                                                                                                                                            SHA-256:D386AFE01C5B0157E144B6083E4E3086C247BFC518CDA6466D20FB97DCF5F3F7
                                                                                                                                                                                            SHA-512:A25EAF4E12E20A824EE628BF5C9916B7A28574F62ECF6274B5CF75C4F0265B6C5A31F507F1F7B54FFCDDB39BE555D1AF60D7319DC5D356BCAF4C28F77B83C5B0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:38.995 1cd8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/03/14-09:11:39.342 1cd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):209
                                                                                                                                                                                            Entropy (8bit):1.8784775129881184
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
                                                                                                                                                                                            MD5:478D49D9CCB25AC14589F834EA70FB9E
                                                                                                                                                                                            SHA1:5D30E87D66E279F8815AFFE4C691AAF1D577A21E
                                                                                                                                                                                            SHA-256:BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
                                                                                                                                                                                            SHA-512:FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):285
                                                                                                                                                                                            Entropy (8bit):5.187739301377863
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEGYfD1wkn23oH+Tcwt86FB2KLlvEGruWdF39+q2Pwkn23oH+Tcwt865IFUv:aGzfYeb/FFLiGruOIvYfYeb/WFUv
                                                                                                                                                                                            MD5:CFCF815EE9512BEA3194925867B54423
                                                                                                                                                                                            SHA1:D4ADF745C6739601BACA3BB21F4B8A566B47B8E7
                                                                                                                                                                                            SHA-256:5EA3E4EEC0E1AA9710D925121BDD954F630DA40B4E60AA2610D0FCFB3D8ED2BD
                                                                                                                                                                                            SHA-512:0DDD784D9A00235DC40C83F5844896ECD7D38ADEB4CA73BE057F89029E4BF9314F51E17934FE52D2900845888AF26E6BAEB6C6AD165501C4E283D3C8C060C168
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:39.355 1cd8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/03/14-09:11:39.622 1cd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1197
                                                                                                                                                                                            Entropy (8bit):1.8784775129881184
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
                                                                                                                                                                                            MD5:A2A3B1383E3AAC2430F44FC7BF3E447E
                                                                                                                                                                                            SHA1:B807210A1205126A107A5FE25F070D2879407AA4
                                                                                                                                                                                            SHA-256:90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
                                                                                                                                                                                            SHA-512:396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):322
                                                                                                                                                                                            Entropy (8bit):5.195931601675308
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEG09+q2Pwkn23oH+Tcwt8NIFUt88EGENJZmw+8EGEN9VkwOwkn23oH+Tcwt8+ed:aGjvYfYebpFUt8fGEX/+fGEF5JfYebqJ
                                                                                                                                                                                            MD5:3462330E58A1B73F1FD7834BA0FDBE4A
                                                                                                                                                                                            SHA1:10CE06DB93BBABD0B4014BFB87BF2520D9D70A6C
                                                                                                                                                                                            SHA-256:B7BB6648D754F6BA0E6D4141D3958216BC2B06F898EE5634D01F8D4E1A799862
                                                                                                                                                                                            SHA-512:5397E26B4A24110E0614312B18C0BF9667A799D4F077FCF3F677AD2C4051E2B96FD5C8489C88EB91D918C3F98FE32D04B5B13A376C049D5E92016F9AB548BD9C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:39.634 1cd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/03/14-09:11:39.636 1cd8 Recovering log #3.2024/03/14-09:11:39.636 1cd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):322
                                                                                                                                                                                            Entropy (8bit):5.195931601675308
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEG09+q2Pwkn23oH+Tcwt8NIFUt88EGENJZmw+8EGEN9VkwOwkn23oH+Tcwt8+ed:aGjvYfYebpFUt8fGEX/+fGEF5JfYebqJ
                                                                                                                                                                                            MD5:3462330E58A1B73F1FD7834BA0FDBE4A
                                                                                                                                                                                            SHA1:10CE06DB93BBABD0B4014BFB87BF2520D9D70A6C
                                                                                                                                                                                            SHA-256:B7BB6648D754F6BA0E6D4141D3958216BC2B06F898EE5634D01F8D4E1A799862
                                                                                                                                                                                            SHA-512:5397E26B4A24110E0614312B18C0BF9667A799D4F077FCF3F677AD2C4051E2B96FD5C8489C88EB91D918C3F98FE32D04B5B13A376C049D5E92016F9AB548BD9C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:39.634 1cd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/03/14-09:11:39.636 1cd8 Recovering log #3.2024/03/14-09:11:39.636 1cd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):4096
                                                                                                                                                                                            Entropy (8bit):0.3169096321222068
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
                                                                                                                                                                                            MD5:2554AD7847B0D04963FDAE908DB81074
                                                                                                                                                                                            SHA1:F84ABD8D05D7B0DFB693485614ECF5204989B74A
                                                                                                                                                                                            SHA-256:F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
                                                                                                                                                                                            SHA-512:13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                            Entropy (8bit):0.40981274649195937
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
                                                                                                                                                                                            MD5:1A7F642FD4F71A656BE75B26B2D9ED79
                                                                                                                                                                                            SHA1:51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
                                                                                                                                                                                            SHA-256:B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
                                                                                                                                                                                            SHA-512:FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):429
                                                                                                                                                                                            Entropy (8bit):5.809210454117189
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
                                                                                                                                                                                            MD5:5D1D9020CCEFD76CA661902E0C229087
                                                                                                                                                                                            SHA1:DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
                                                                                                                                                                                            SHA-256:B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
                                                                                                                                                                                            SHA-512:5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):159744
                                                                                                                                                                                            Entropy (8bit):0.5241404324800358
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
                                                                                                                                                                                            MD5:241322143A01979D346689D9448AC8C0
                                                                                                                                                                                            SHA1:DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
                                                                                                                                                                                            SHA-256:65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
                                                                                                                                                                                            SHA-512:9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8720
                                                                                                                                                                                            Entropy (8bit):0.32872990409968056
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:OA/J3+t76Y4QZZofU99pO0BYKkqR4EZY4QZvG6a:vhHQws9LdlBQZG6a
                                                                                                                                                                                            MD5:E3F8DC0289463369D560D6F5E377DF65
                                                                                                                                                                                            SHA1:4C8F415E44E3AEF609089AB1951A07717D31BD5F
                                                                                                                                                                                            SHA-256:A05C0C2B122E5D13C200AEF213AB3EA5957F00BCF36132388446BB714F198753
                                                                                                                                                                                            SHA-512:004A5D6B73D94A7817F9E33D1AD513439267496FB65FA76D09DA388447D1249D4A814B7BC141DFA1B5CD5AC798D733E13611E3FE0706352E6E3842869BB25C7C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:............O......'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):28672
                                                                                                                                                                                            Entropy (8bit):0.33890226319329847
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
                                                                                                                                                                                            MD5:971F4C153D386AC7ED39363C31E854FC
                                                                                                                                                                                            SHA1:339841CA0088C9EABDE4AACC8567D2289CCB9544
                                                                                                                                                                                            SHA-256:B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
                                                                                                                                                                                            SHA-512:1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):406
                                                                                                                                                                                            Entropy (8bit):5.218836223195298
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:aGiHIvYfYeb8rcHEZrELFUt8fGb5/+fGbT5JfYeb8rcHEZrEZSJ:aGiH6YfYeb8nZrExg8fGcGZJfYeb8nZR
                                                                                                                                                                                            MD5:408458A56BF9621CCE07B3F0B47FF4B8
                                                                                                                                                                                            SHA1:FCFE38BE9C406125762AF48DF071D9055048FBC7
                                                                                                                                                                                            SHA-256:3A35CF422E142EC8A531D1997B813FCE7F84451697E63C6B50570933B669051B
                                                                                                                                                                                            SHA-512:FB2A33E0594A726A92739571D539C260CCD7F49C2B35B444F0DA13FC7FFDFCBFD2A6428541A0E08306B1F8D3A302CD7BBF67188ECE278DEA020938913B7604A5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:41.002 1cd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/03/14-09:11:41.003 1cd8 Recovering log #3.2024/03/14-09:11:41.003 1cd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):406
                                                                                                                                                                                            Entropy (8bit):5.218836223195298
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:aGiHIvYfYeb8rcHEZrELFUt8fGb5/+fGbT5JfYeb8rcHEZrEZSJ:aGiH6YfYeb8nZrExg8fGcGZJfYeb8nZR
                                                                                                                                                                                            MD5:408458A56BF9621CCE07B3F0B47FF4B8
                                                                                                                                                                                            SHA1:FCFE38BE9C406125762AF48DF071D9055048FBC7
                                                                                                                                                                                            SHA-256:3A35CF422E142EC8A531D1997B813FCE7F84451697E63C6B50570933B669051B
                                                                                                                                                                                            SHA-512:FB2A33E0594A726A92739571D539C260CCD7F49C2B35B444F0DA13FC7FFDFCBFD2A6428541A0E08306B1F8D3A302CD7BBF67188ECE278DEA020938913B7604A5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:41.002 1cd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/03/14-09:11:41.003 1cd8 Recovering log #3.2024/03/14-09:11:41.003 1cd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):334
                                                                                                                                                                                            Entropy (8bit):5.130645704245041
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEG5F34q2Pwkn23oH+Tcwt8a2jMGIFUt88EGwFnJZmw+8EGrU+DkwOwkn23oH+Tg:aG5OvYfYeb8EFUt8fGwr/+fGrD5JfYek
                                                                                                                                                                                            MD5:94100265FE9F49AE188C19A187F690EF
                                                                                                                                                                                            SHA1:71BECDFD60180D43B1D0123A4A247CE4EEDB057C
                                                                                                                                                                                            SHA-256:BD0434774F84594B0BAFE6FCF2DF93CB2F3F0972D7C8F1D96E0730F78990B4A6
                                                                                                                                                                                            SHA-512:590FC70A6881BC8BD5B7C831FB5B9B7894AE7335E421511A66866DFA183B5C0C78A3E4EF771052C81ED8D4FFB8F530DDA46CAF81B43C04CF85626B5326A96A95
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:39.916 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/03/14-09:11:39.917 1e40 Recovering log #3.2024/03/14-09:11:39.923 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):334
                                                                                                                                                                                            Entropy (8bit):5.130645704245041
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEG5F34q2Pwkn23oH+Tcwt8a2jMGIFUt88EGwFnJZmw+8EGrU+DkwOwkn23oH+Tg:aG5OvYfYeb8EFUt8fGwr/+fGrD5JfYek
                                                                                                                                                                                            MD5:94100265FE9F49AE188C19A187F690EF
                                                                                                                                                                                            SHA1:71BECDFD60180D43B1D0123A4A247CE4EEDB057C
                                                                                                                                                                                            SHA-256:BD0434774F84594B0BAFE6FCF2DF93CB2F3F0972D7C8F1D96E0730F78990B4A6
                                                                                                                                                                                            SHA-512:590FC70A6881BC8BD5B7C831FB5B9B7894AE7335E421511A66866DFA183B5C0C78A3E4EF771052C81ED8D4FFB8F530DDA46CAF81B43C04CF85626B5326A96A95
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:39.916 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/03/14-09:11:39.917 1e40 Recovering log #3.2024/03/14-09:11:39.923 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):57344
                                                                                                                                                                                            Entropy (8bit):0.863060653641558
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
                                                                                                                                                                                            MD5:C681C90B3AAD7F7E4AF8664DE16971DF
                                                                                                                                                                                            SHA1:9F72588CEA6569261291B19E06043A1EFC3653BC
                                                                                                                                                                                            SHA-256:ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
                                                                                                                                                                                            SHA-512:4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):45056
                                                                                                                                                                                            Entropy (8bit):0.40293591932113104
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
                                                                                                                                                                                            MD5:ADC0CFB8A1A20DE2C4AB738B413CBEA4
                                                                                                                                                                                            SHA1:238EF489E5FDC6EBB36F09D415FB353350E7097B
                                                                                                                                                                                            SHA-256:7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
                                                                                                                                                                                            SHA-512:38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0141139b-59ed-4b65-ac6c-947aee1f5118.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:H:H
                                                                                                                                                                                            MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                            SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                            SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                            SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[]

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\88f0fb51-564c-4aac-b49f-a6cf165054fc.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):188
                                                                                                                                                                                            Entropy (8bit):5.423404609678128
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
                                                                                                                                                                                            MD5:6833E2FEEACF2930174137246FC7E09F
                                                                                                                                                                                            SHA1:7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
                                                                                                                                                                                            SHA-256:839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
                                                                                                                                                                                            SHA-512:B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                            Entropy (8bit):0.6732424250451717
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                            MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                            SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                            SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                            SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):61
                                                                                                                                                                                            Entropy (8bit):3.926136109079379
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                                                                                                                            MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                                                                                                                            SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                                                                                                                            SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                                                                                                                            SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2ed92.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):61
                                                                                                                                                                                            Entropy (8bit):3.926136109079379
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                                                                                                                            MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                                                                                                                            SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                                                                                                                            SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                                                                                                                            SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3d802.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):61
                                                                                                                                                                                            Entropy (8bit):3.926136109079379
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                                                                                                                            MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                                                                                                                            SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                                                                                                                            SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                                                                                                                            SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):36864
                                                                                                                                                                                            Entropy (8bit):0.555790634850688
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
                                                                                                                                                                                            MD5:0247E46DE79B6CD1BF08CAF7782F7793
                                                                                                                                                                                            SHA1:B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
                                                                                                                                                                                            SHA-256:AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
                                                                                                                                                                                            SHA-512:148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:H:H
                                                                                                                                                                                            MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                            SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                            SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                            SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[]

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2d094.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:H:H
                                                                                                                                                                                            MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                            SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                            SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                            SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[]

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2f245.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:H:H
                                                                                                                                                                                            MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                            SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                            SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                            SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[]

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):40
                                                                                                                                                                                            Entropy (8bit):4.1275671571169275
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                            MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                            SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                            SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                            SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):203
                                                                                                                                                                                            Entropy (8bit):5.4042796420747425
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                                                                                                                            MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                                                                                                                            SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                                                                                                                            SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                                                                                                                            SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2ed83.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):203
                                                                                                                                                                                            Entropy (8bit):5.4042796420747425
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                                                                                                                            MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                                                                                                                            SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                                                                                                                            SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                                                                                                                            SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):36864
                                                                                                                                                                                            Entropy (8bit):0.36515621748816035
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                                                                                                                            MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                                                                                                                            SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                                                                                                                            SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                                                                                                                            SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b4b02fc6-551f-405b-8bc1-f76d06b52717.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):40
                                                                                                                                                                                            Entropy (8bit):4.1275671571169275
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                            MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                            SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                            SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                            SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\bd67d88d-3d2e-4b9a-8fd4-8d766443f44f.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):881
                                                                                                                                                                                            Entropy (8bit):5.313919395232915
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:YXsUZVMdBsWEyZFRudFGcsvZFGJ/dbG7nby:YXsM8sWRfcdsRgzbZ
                                                                                                                                                                                            MD5:592C048686335A200048745FCAA5C743
                                                                                                                                                                                            SHA1:362B10AD5D3FEBC5E819039869CC1BAA4153AFE6
                                                                                                                                                                                            SHA-256:7C3F11F10126024F10C7A3979DED33C3F69EC6024CF456569B6A5913E4737CD1
                                                                                                                                                                                            SHA-512:5725B86AE0B25DA96869206E0DC89D4D33EAF2411DB6E0BEA1C06379CEDFC53D20FFFCF2258505B768FF92F03238EEE823C0F3EE672EC7904F946FC6744A7EEC
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357469501718457","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357469502420296","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357469519687603","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d3342760-9d0d-41eb-b6aa-8b59b3a0fde3.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:H:H
                                                                                                                                                                                            MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                            SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                            SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                            SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[]

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e6ca3a09-e44f-4a4b-b82a-d4719a8a3b7b.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):111
                                                                                                                                                                                            Entropy (8bit):4.718418993774295
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
                                                                                                                                                                                            MD5:285252A2F6327D41EAB203DC2F402C67
                                                                                                                                                                                            SHA1:ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
                                                                                                                                                                                            SHA-256:5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
                                                                                                                                                                                            SHA-512:11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f31f9908-9937-4578-9a18-c1822488cc20.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:H:H
                                                                                                                                                                                            MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                            SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                            SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                            SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[]

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                            Entropy (8bit):0.46731661083066856
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
                                                                                                                                                                                            MD5:E93ACF0820CA08E5A5D2D159729F70E3
                                                                                                                                                                                            SHA1:2C1A4D4924B9AEC1A796F108607404B000877C5D
                                                                                                                                                                                            SHA-256:F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
                                                                                                                                                                                            SHA-512:3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):7726
                                                                                                                                                                                            Entropy (8bit):4.915233456906699
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:sVzql5J1VoXb9JvTdbrNYkedY5Th6Cp9/x+6M8muecmAeCQe4zvry2X6gS5AtEHb:sVzSJs3bdvNYkAYPpj+FVAayFJf
                                                                                                                                                                                            MD5:53FE659F3C98304004DBDA6CBB70DEA1
                                                                                                                                                                                            SHA1:7879BAD2FE022D68BDB6E1319C9075E84CE8FCB5
                                                                                                                                                                                            SHA-256:E285A7CEF11E92FE17E38F8FF679712BD5B53637C2CF80168EDEA989F00EEAC9
                                                                                                                                                                                            SHA-512:CB53858986463EAB7D59CAC9A7619ECE014321FC94ED60CF6782F790A037B4E6C23C52B093D4A6C7EBA6C37949F80CEC89EB78B3041520623D9B00FE538DAFBA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354877499400966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2f89e.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):7726
                                                                                                                                                                                            Entropy (8bit):4.915233456906699
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:sVzql5J1VoXb9JvTdbrNYkedY5Th6Cp9/x+6M8muecmAeCQe4zvry2X6gS5AtEHb:sVzSJs3bdvNYkAYPpj+FVAayFJf
                                                                                                                                                                                            MD5:53FE659F3C98304004DBDA6CBB70DEA1
                                                                                                                                                                                            SHA1:7879BAD2FE022D68BDB6E1319C9075E84CE8FCB5
                                                                                                                                                                                            SHA-256:E285A7CEF11E92FE17E38F8FF679712BD5B53637C2CF80168EDEA989F00EEAC9
                                                                                                                                                                                            SHA-512:CB53858986463EAB7D59CAC9A7619ECE014321FC94ED60CF6782F790A037B4E6C23C52B093D4A6C7EBA6C37949F80CEC89EB78B3041520623D9B00FE538DAFBA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354877499400966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF33450.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):7726
                                                                                                                                                                                            Entropy (8bit):4.915233456906699
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:sVzql5J1VoXb9JvTdbrNYkedY5Th6Cp9/x+6M8muecmAeCQe4zvry2X6gS5AtEHb:sVzSJs3bdvNYkAYPpj+FVAayFJf
                                                                                                                                                                                            MD5:53FE659F3C98304004DBDA6CBB70DEA1
                                                                                                                                                                                            SHA1:7879BAD2FE022D68BDB6E1319C9075E84CE8FCB5
                                                                                                                                                                                            SHA-256:E285A7CEF11E92FE17E38F8FF679712BD5B53637C2CF80168EDEA989F00EEAC9
                                                                                                                                                                                            SHA-512:CB53858986463EAB7D59CAC9A7619ECE014321FC94ED60CF6782F790A037B4E6C23C52B093D4A6C7EBA6C37949F80CEC89EB78B3041520623D9B00FE538DAFBA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354877499400966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF37001.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):7726
                                                                                                                                                                                            Entropy (8bit):4.915233456906699
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:sVzql5J1VoXb9JvTdbrNYkedY5Th6Cp9/x+6M8muecmAeCQe4zvry2X6gS5AtEHb:sVzSJs3bdvNYkAYPpj+FVAayFJf
                                                                                                                                                                                            MD5:53FE659F3C98304004DBDA6CBB70DEA1
                                                                                                                                                                                            SHA1:7879BAD2FE022D68BDB6E1319C9075E84CE8FCB5
                                                                                                                                                                                            SHA-256:E285A7CEF11E92FE17E38F8FF679712BD5B53637C2CF80168EDEA989F00EEAC9
                                                                                                                                                                                            SHA-512:CB53858986463EAB7D59CAC9A7619ECE014321FC94ED60CF6782F790A037B4E6C23C52B093D4A6C7EBA6C37949F80CEC89EB78B3041520623D9B00FE538DAFBA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354877499400966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3b528.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):7726
                                                                                                                                                                                            Entropy (8bit):4.915233456906699
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:sVzql5J1VoXb9JvTdbrNYkedY5Th6Cp9/x+6M8muecmAeCQe4zvry2X6gS5AtEHb:sVzSJs3bdvNYkAYPpj+FVAayFJf
                                                                                                                                                                                            MD5:53FE659F3C98304004DBDA6CBB70DEA1
                                                                                                                                                                                            SHA1:7879BAD2FE022D68BDB6E1319C9075E84CE8FCB5
                                                                                                                                                                                            SHA-256:E285A7CEF11E92FE17E38F8FF679712BD5B53637C2CF80168EDEA989F00EEAC9
                                                                                                                                                                                            SHA-512:CB53858986463EAB7D59CAC9A7619ECE014321FC94ED60CF6782F790A037B4E6C23C52B093D4A6C7EBA6C37949F80CEC89EB78B3041520623D9B00FE538DAFBA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354877499400966","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):33
                                                                                                                                                                                            Entropy (8bit):4.051821770808046
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:YVXADAEvTLSJ:Y9AcEvHSJ
                                                                                                                                                                                            MD5:2B432FEF211C69C745ACA86DE4F8E4AB
                                                                                                                                                                                            SHA1:4B92DA8D4C0188CF2409500ADCD2200444A82FCC
                                                                                                                                                                                            SHA-256:42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
                                                                                                                                                                                            SHA-512:948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"preferred_apps":[],"version":1}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):25012
                                                                                                                                                                                            Entropy (8bit):5.568210220440691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:REWovRWPSofrq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxYdeMrwBbxpdtum:REWovRWPSofrqu1ja0OelNltJ
                                                                                                                                                                                            MD5:1D2FF791DE2DADB418DE35D9D09E8C96
                                                                                                                                                                                            SHA1:7B1F7C210501536CEFDDA42F2FF37D5C39CE39BF
                                                                                                                                                                                            SHA-256:FA3A80E01165A7439DC4CF54500665E9CF18A26F6EA83B2A144BE0788932B0D9
                                                                                                                                                                                            SHA-512:475014F630C0352EBDE2703A6D579D3B649D1E15CD19C2F8C9DF355DAA634E57F221B81FA55F2790EE3126C6EEF0CAF52A3418336CC7D879C3BB656AB6DBFED1
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13354877498968934","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13354877498968934","location":5,"ma

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF30dad.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):25012
                                                                                                                                                                                            Entropy (8bit):5.568210220440691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:REWovRWPSofrq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxYdeMrwBbxpdtum:REWovRWPSofrqu1ja0OelNltJ
                                                                                                                                                                                            MD5:1D2FF791DE2DADB418DE35D9D09E8C96
                                                                                                                                                                                            SHA1:7B1F7C210501536CEFDDA42F2FF37D5C39CE39BF
                                                                                                                                                                                            SHA-256:FA3A80E01165A7439DC4CF54500665E9CF18A26F6EA83B2A144BE0788932B0D9
                                                                                                                                                                                            SHA-512:475014F630C0352EBDE2703A6D579D3B649D1E15CD19C2F8C9DF355DAA634E57F221B81FA55F2790EE3126C6EEF0CAF52A3418336CC7D879C3BB656AB6DBFED1
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13354877498968934","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13354877498968934","location":5,"ma

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):232
                                                                                                                                                                                            Entropy (8bit):2.7061121767675385
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
                                                                                                                                                                                            MD5:8A30A1FDD0459D9EA8B1E78A8E636856
                                                                                                                                                                                            SHA1:9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
                                                                                                                                                                                            SHA-256:88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
                                                                                                                                                                                            SHA-512:B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):322
                                                                                                                                                                                            Entropy (8bit):5.106313179204523
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEGs7N4q2Pwkn23oH+TcwtrQMxIFUt88EGkk3JZmw+8EGKBDkwOwkn23oH+Tcwtf:aGmOvYfYebCFUt8fGnZ/+fGKh5JfYebf
                                                                                                                                                                                            MD5:4CB91ED40DB3A4A38FFA59F82C958CE1
                                                                                                                                                                                            SHA1:C157345177D0A75E28114C3BC88B57626AB37FF6
                                                                                                                                                                                            SHA-256:7823532E8A753522EE0F8AF47931D170BFB0A2FE1EDE91D9D03DCF39E9EDDD8D
                                                                                                                                                                                            SHA-512:B279D5DEA500A20B578BC3D2F35CE8FC1B9A6127A3EE0F452F83DFE5BCE1ADC3DAFBF2B466F5B22C5477D349DF85D95743040B6602437E2A54B200AE381249B8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:56.008 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/03/14-09:11:56.009 1e40 Recovering log #3.2024/03/14-09:11:56.020 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):322
                                                                                                                                                                                            Entropy (8bit):5.106313179204523
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEGs7N4q2Pwkn23oH+TcwtrQMxIFUt88EGkk3JZmw+8EGKBDkwOwkn23oH+Tcwtf:aGmOvYfYebCFUt8fGnZ/+fGKh5JfYebf
                                                                                                                                                                                            MD5:4CB91ED40DB3A4A38FFA59F82C958CE1
                                                                                                                                                                                            SHA1:C157345177D0A75E28114C3BC88B57626AB37FF6
                                                                                                                                                                                            SHA-256:7823532E8A753522EE0F8AF47931D170BFB0A2FE1EDE91D9D03DCF39E9EDDD8D
                                                                                                                                                                                            SHA-512:B279D5DEA500A20B578BC3D2F35CE8FC1B9A6127A3EE0F452F83DFE5BCE1ADC3DAFBF2B466F5B22C5477D349DF85D95743040B6602437E2A54B200AE381249B8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:56.008 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/03/14-09:11:56.009 1e40 Recovering log #3.2024/03/14-09:11:56.020 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):350
                                                                                                                                                                                            Entropy (8bit):5.169966926669264
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEG5tUx9+q2Pwkn23oH+Tcwt7Uh2ghZIFUt88EGzFYNNJZmw+8EG5x9VkwOwkn20:aG5tUx4vYfYebIhHh2FUt8fGpUJ/+fG8
                                                                                                                                                                                            MD5:EFF6C96FA3704C8D8C5DB73AC5F9A42A
                                                                                                                                                                                            SHA1:48F3E524F52E39EBDFCD3DA47118A53D7931F904
                                                                                                                                                                                            SHA-256:230CB4C6BEBF9346957462F34A94D420D7BAC176DCF1AA2683AE2B3A3228F2CF
                                                                                                                                                                                            SHA-512:0120FB7FD5A1A4CB148AB30B88D7DFFE22A5D5D80F07926B194E00144EC49586DD90AA22B35ABC308C625264840AD3AC6FD0982DDBB11A230D2081B3935F235B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:38.988 1d28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/03/14-09:11:39.006 1d28 Recovering log #3.2024/03/14-09:11:39.027 1d28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):350
                                                                                                                                                                                            Entropy (8bit):5.169966926669264
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEG5tUx9+q2Pwkn23oH+Tcwt7Uh2ghZIFUt88EGzFYNNJZmw+8EG5x9VkwOwkn20:aG5tUx4vYfYebIhHh2FUt8fGpUJ/+fG8
                                                                                                                                                                                            MD5:EFF6C96FA3704C8D8C5DB73AC5F9A42A
                                                                                                                                                                                            SHA1:48F3E524F52E39EBDFCD3DA47118A53D7931F904
                                                                                                                                                                                            SHA-256:230CB4C6BEBF9346957462F34A94D420D7BAC176DCF1AA2683AE2B3A3228F2CF
                                                                                                                                                                                            SHA-512:0120FB7FD5A1A4CB148AB30B88D7DFFE22A5D5D80F07926B194E00144EC49586DD90AA22B35ABC308C625264840AD3AC6FD0982DDBB11A230D2081B3935F235B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:38.988 1d28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/03/14-09:11:39.006 1d28 Recovering log #3.2024/03/14-09:11:39.027 1d28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.01057775872642915
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsFl:/F
                                                                                                                                                                                            MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                            SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                            SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                            SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                            Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                            MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                            SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                            SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                            SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.011852361981932763
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                            MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                            SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                            SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                            SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.012340643231932763
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                            MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                            SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                            SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                            SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):524656
                                                                                                                                                                                            Entropy (8bit):5.027445846313988E-4
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:Lsulwke:LsLn
                                                                                                                                                                                            MD5:3D43D5984C6EC6D76E55A5B74C0E0FA4
                                                                                                                                                                                            SHA1:46679594CF2FEE930DAD796A8E828CD3EE2AF010
                                                                                                                                                                                            SHA-256:0DB845BC8AAD997210A76750B32EDC95CE63DFC3FD875C96985318ADE51DAC3C
                                                                                                                                                                                            SHA-512:CCB56E6CFAE8F6FF1F5BBCBBE86E66F49D06653492768EE791FD53B13E386A3EFF8E7AA6FA782713483A600791BB74DB4719B0D59ADCF636CDFA56923F64A9D1
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................b..0r/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.01057775872642915
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsFl:/F
                                                                                                                                                                                            MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                            SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                            SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                            SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                            Entropy (8bit):0.0012471779557650352
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                                            MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                                            SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                                            SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                                            SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.011852361981932763
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                            MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                            SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                            SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                            SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.012340643231932763
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                            MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                            SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                            SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                            SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):262512
                                                                                                                                                                                            Entropy (8bit):9.47693366977411E-4
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:LsNl5ull:Ls3kl
                                                                                                                                                                                            MD5:905E2FFBB887D4F78DD27CC2D8C03C76
                                                                                                                                                                                            SHA1:DBB85A31283DE3CDE3FD3332687AD9EC74F39603
                                                                                                                                                                                            SHA-256:12BAB051AD480D6876C040D4933A4CC80931FF2820038A0FE1187B14A622D783
                                                                                                                                                                                            SHA-512:53CD48C5C4335B48A85AB896E470CC4C3B9BA848B2FD51C24BECE0451FFDA24C033C288CAB97A70E87610EAC46F886AA091A9FB90E5F37381C8C604FFBE680DB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......................................../[a.0r/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                            Entropy (8bit):0.0012471779557650352
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                                            MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                                            SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                                            SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                                            SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):432
                                                                                                                                                                                            Entropy (8bit):5.206499497938717
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:aG3vYfYebvqBQFUt8fGQ4/+fG2R75JfYebvqBvJ:aGfYfYebvZg8fGkGoJfYebvk
                                                                                                                                                                                            MD5:FAD76C6F43565DCDE0074E60CAB2F020
                                                                                                                                                                                            SHA1:B9D43281D37F382749C23A916D9F3F07B8D8316C
                                                                                                                                                                                            SHA-256:5C832AD1BEE3897CB8B31BADD2A1CE6F30A4923135C72C079541E95CDB88FE9C
                                                                                                                                                                                            SHA-512:8047680FA5E5EE6739897574D9E739D9D142DAB39E5C8914E888E2EB93D7BE970A75E8D67832897874BD7CC66F69852EC5BD297C6A5D4BD922C8CFEF331FF8E6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:39.940 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/03/14-09:11:39.941 1e40 Recovering log #3.2024/03/14-09:11:39.948 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):432
                                                                                                                                                                                            Entropy (8bit):5.206499497938717
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:aG3vYfYebvqBQFUt8fGQ4/+fG2R75JfYebvqBvJ:aGfYfYebvZg8fGkGoJfYebvk
                                                                                                                                                                                            MD5:FAD76C6F43565DCDE0074E60CAB2F020
                                                                                                                                                                                            SHA1:B9D43281D37F382749C23A916D9F3F07B8D8316C
                                                                                                                                                                                            SHA-256:5C832AD1BEE3897CB8B31BADD2A1CE6F30A4923135C72C079541E95CDB88FE9C
                                                                                                                                                                                            SHA-512:8047680FA5E5EE6739897574D9E739D9D142DAB39E5C8914E888E2EB93D7BE970A75E8D67832897874BD7CC66F69852EC5BD297C6A5D4BD922C8CFEF331FF8E6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:39.940 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/03/14-09:11:39.941 1e40 Recovering log #3.2024/03/14-09:11:39.948 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\04cb1a21-2785-47ce-b25a-fca9ca23d21c.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:H:H
                                                                                                                                                                                            MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                            SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                            SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                            SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[]

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\520e8b10-4782-418b-a252-92bb577517c2.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:H:H
                                                                                                                                                                                            MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                            SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                            SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                            SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[]

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\755258f6-278c-4a32-bd06-432241e1aa9f.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):40
                                                                                                                                                                                            Entropy (8bit):4.1275671571169275
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                            MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                            SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                            SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                            SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):193
                                                                                                                                                                                            Entropy (8bit):4.864047146590611
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                                                                                                                            MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                                                                                                                            SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                                                                                                                            SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                                                                                                                            SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3d811.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):193
                                                                                                                                                                                            Entropy (8bit):4.864047146590611
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                                                                                                                            MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                                                                                                                            SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                                                                                                                            SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                                                                                                                            SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):36864
                                                                                                                                                                                            Entropy (8bit):0.555790634850688
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
                                                                                                                                                                                            MD5:0247E46DE79B6CD1BF08CAF7782F7793
                                                                                                                                                                                            SHA1:B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
                                                                                                                                                                                            SHA-256:AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
                                                                                                                                                                                            SHA-512:148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:H:H
                                                                                                                                                                                            MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                            SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                            SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                            SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[]

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2f245.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:H:H
                                                                                                                                                                                            MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                            SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                            SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                            SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[]

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):40
                                                                                                                                                                                            Entropy (8bit):4.1275671571169275
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                            MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                            SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                            SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                            SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):36864
                                                                                                                                                                                            Entropy (8bit):0.36515621748816035
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                                                                                                                            MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                                                                                                                            SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                                                                                                                            SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                                                                                                                            SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\abd4f351-756d-47cb-83d8-c83228b44f31.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):111
                                                                                                                                                                                            Entropy (8bit):4.718418993774295
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
                                                                                                                                                                                            MD5:285252A2F6327D41EAB203DC2F402C67
                                                                                                                                                                                            SHA1:ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
                                                                                                                                                                                            SHA-256:5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
                                                                                                                                                                                            SHA-512:11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):80
                                                                                                                                                                                            Entropy (8bit):3.4921535629071894
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
                                                                                                                                                                                            MD5:69449520FD9C139C534E2970342C6BD8
                                                                                                                                                                                            SHA1:230FE369A09DEF748F8CC23AD70FD19ED8D1B885
                                                                                                                                                                                            SHA-256:3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
                                                                                                                                                                                            SHA-512:EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:*...#................version.1..namespace-..&f.................&f...............

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):420
                                                                                                                                                                                            Entropy (8bit):5.247394629410235
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:aGvOvYfYebvqBZFUt8fGM/+fGez5JfYebvqBaJ:aGUYfYebvyg8fGhGelJfYebvL
                                                                                                                                                                                            MD5:3747C21D9EED11663628A46BCD4D7EBE
                                                                                                                                                                                            SHA1:EEA197112B463AC29C0E09DDB19C94D0030D5372
                                                                                                                                                                                            SHA-256:1DB3184A265DE97B24A8E9A1C4C6E8EEFD40ED3260F34AAAD6C4316A7067CBDB
                                                                                                                                                                                            SHA-512:B147EB72613FAA6D06B8C55911B9C1B78EDE5C867A0730E21C307DEAB8A12D049C55364EE8ECDAB53CCC0D63E5419ECF1C7C76A6FF8E33D53B164DAE34245D5B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:56.072 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/03/14-09:11:56.073 1e40 Recovering log #3.2024/03/14-09:11:56.079 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):420
                                                                                                                                                                                            Entropy (8bit):5.247394629410235
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:aGvOvYfYebvqBZFUt8fGM/+fGez5JfYebvqBaJ:aGUYfYebvyg8fGhGelJfYebvL
                                                                                                                                                                                            MD5:3747C21D9EED11663628A46BCD4D7EBE
                                                                                                                                                                                            SHA1:EEA197112B463AC29C0E09DDB19C94D0030D5372
                                                                                                                                                                                            SHA-256:1DB3184A265DE97B24A8E9A1C4C6E8EEFD40ED3260F34AAAD6C4316A7067CBDB
                                                                                                                                                                                            SHA-512:B147EB72613FAA6D06B8C55911B9C1B78EDE5C867A0730E21C307DEAB8A12D049C55364EE8ECDAB53CCC0D63E5419ECF1C7C76A6FF8E33D53B164DAE34245D5B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:56.072 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/03/14-09:11:56.073 1e40 Recovering log #3.2024/03/14-09:11:56.079 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):326
                                                                                                                                                                                            Entropy (8bit):5.2152529906909075
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEG5lHyq2Pwkn23oH+TcwtpIFUt88EG5O1Zmw+8EGqRkwOwkn23oH+Tcwta/WLJ:aG5kvYfYebmFUt8fG5O1/+fGO5JfYeb7
                                                                                                                                                                                            MD5:08C90F6F12354DD32CCB08F7D85BB018
                                                                                                                                                                                            SHA1:26E7917DC8B59A56351358666B236650D9DE1B67
                                                                                                                                                                                            SHA-256:184949A667E545799CD15D1234415D4F5C311D2BDACDB5954ED9287103859F69
                                                                                                                                                                                            SHA-512:12AE0D1BBD95BB789B4B3788D4D1E8644D962C4C8152B40DF558D58760012447A01F35DF390C1CF37554A8C9FFB37A907AF717D0E68D354BA7DD894D1A56A830
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:38.973 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/03/14-09:11:38.996 1d30 Recovering log #3.2024/03/14-09:11:39.005 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):326
                                                                                                                                                                                            Entropy (8bit):5.2152529906909075
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEG5lHyq2Pwkn23oH+TcwtpIFUt88EG5O1Zmw+8EGqRkwOwkn23oH+Tcwta/WLJ:aG5kvYfYebmFUt8fG5O1/+fGO5JfYeb7
                                                                                                                                                                                            MD5:08C90F6F12354DD32CCB08F7D85BB018
                                                                                                                                                                                            SHA1:26E7917DC8B59A56351358666B236650D9DE1B67
                                                                                                                                                                                            SHA-256:184949A667E545799CD15D1234415D4F5C311D2BDACDB5954ED9287103859F69
                                                                                                                                                                                            SHA-512:12AE0D1BBD95BB789B4B3788D4D1E8644D962C4C8152B40DF558D58760012447A01F35DF390C1CF37554A8C9FFB37A907AF717D0E68D354BA7DD894D1A56A830
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:38.973 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/03/14-09:11:38.996 1d30 Recovering log #3.2024/03/14-09:11:39.005 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):28672
                                                                                                                                                                                            Entropy (8bit):0.26707851465859517
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
                                                                                                                                                                                            MD5:04F8B790DF73BD7CD01238F4681C3F44
                                                                                                                                                                                            SHA1:DF12D0A21935FC01B36A24BF72AB9640FEBB2077
                                                                                                                                                                                            SHA-256:96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
                                                                                                                                                                                            SHA-512:0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):180224
                                                                                                                                                                                            Entropy (8bit):0.9237410161604507
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
                                                                                                                                                                                            MD5:C97C2FBAAEA45BB3C728D02689216CB2
                                                                                                                                                                                            SHA1:CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
                                                                                                                                                                                            SHA-256:DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
                                                                                                                                                                                            SHA-512:5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2568
                                                                                                                                                                                            Entropy (8bit):0.06569804787746028
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:ycl1lhtlM:yc3c
                                                                                                                                                                                            MD5:59EB1FF44858969344570EC63A059508
                                                                                                                                                                                            SHA1:915F75BCCD88F439FE1386965ECCA4D9DDB11AE7
                                                                                                                                                                                            SHA-256:489908C46E51FA141EE26B6A4462C781A232346058BF761E78496B65A2F47CF8
                                                                                                                                                                                            SHA-512:6537FB043BF0539C20EFF506D48685423BDDDBD981F014C04942A30CA383239E286835CD405FDD2C06C7C4B3C19AB927C86CDDE35092980C4260844D416701C6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:..............2....W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\adf2f108-fa45-4734-b940-a86326ef30ba.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):30096
                                                                                                                                                                                            Entropy (8bit):5.567563234273509
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:REWohQLoLqgRWPSofAq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxKSYdeMrwyqpdtuU:REWoheWqgRWPSofAqu1jaQKSOelftL
                                                                                                                                                                                            MD5:A0229D3E77151A1484622AC0141A9F63
                                                                                                                                                                                            SHA1:074B394B72919771F4A4D594B554E4A4E6ADD851
                                                                                                                                                                                            SHA-256:853CD583D216A05B072CE4A128CB382A44A4395E537758CDD9957430009C0452
                                                                                                                                                                                            SHA-512:F5C16FCD46565E28D080E78F3F777065F2DE3FC3D32D1DB600E615D82645111AA7984B8A258E78B24E725D9007358862907C80DBE7ECCA11A76811007B80EAFF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13354877498968934","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13354877498968934","location":5,"ma

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text, with very long lines (3951), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):11755
                                                                                                                                                                                            Entropy (8bit):5.190465908239046
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
                                                                                                                                                                                            MD5:07301A857C41B5854E6F84CA00B81EA0
                                                                                                                                                                                            SHA1:7441FC1018508FF4F3DBAA139A21634C08ED979C
                                                                                                                                                                                            SHA-256:2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
                                                                                                                                                                                            SHA-512:00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                            Entropy (8bit):0.35226517389931394
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
                                                                                                                                                                                            MD5:D2CCDC36225684AAE8FA563AFEDB14E7
                                                                                                                                                                                            SHA1:3759649035F23004A4C30A14C5F0B54191BEBF80
                                                                                                                                                                                            SHA-256:080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
                                                                                                                                                                                            SHA-512:1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                            Entropy (8bit):0.017262956703125623
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                            MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                            SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                            SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                            SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1471
                                                                                                                                                                                            Entropy (8bit):5.507868665677189
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:pY83SBS8L/o/OCP1WhHRHoIIOt2YKIt2YKR3KcQQNkQuMYKIMYKEybAlkfAlk9Hi:q83SBSqQrPGHRHoxOIYjIYgzQqkBMYjh
                                                                                                                                                                                            MD5:4ABAD863043D256D9B9643A94FAB0E82
                                                                                                                                                                                            SHA1:F06D65EE5529120242264A452265EBAEE8ACCE28
                                                                                                                                                                                            SHA-256:3DACBAFFBC97A90A86C7302B526E8611886ED511EC0C2EA0A2C1AF80D8B4CF30
                                                                                                                                                                                            SHA-512:DA877CB7CC03C2B0BF9F979A8B828DFBF0143223E64B92BDCD60A1E3C700DAD3558DDD68BB912EF5F95332C5EFA5F0CAECA65DB0B6C4501FAC26C5A31AB1EB71
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:A..r.................20_1_1...1.,U.................20_1_1...1..!..................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch.....4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton....&4_IPH_FocusHelpBubbleScreenReaderPromo*.$IPH_FocusHelpBubbleScreenReaderPromo.....4_IPH_GMCCastStartStop...IPH_GMCCastStartStop.....4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode.....4_IPH_LiveCaption...IPH_LiveCaption.....4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage...."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature.....4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature....&4_IPH_PriceTrackingEmailConsentFeature*.$IPH_PriceTrackingEmailConsentFeature....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature.....4_IPH_De

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):281
                                                                                                                                                                                            Entropy (8bit):5.199658092072553
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEGxR1wkn23oH+Tcwtfrl2KLlvEGLJq2Pwkn23oH+TcwtfrK+IFUv:aGOfYeb1LiGLJvYfYeb23FUv
                                                                                                                                                                                            MD5:53F66EEDAA81EB474D041C8BF462E952
                                                                                                                                                                                            SHA1:99A51B0929657553CF15B8D2DB3C56F8EA9DFC39
                                                                                                                                                                                            SHA-256:0C24BF493AF2AAA5A8247A5B67E72B0688C8A9954B397006A9767B8FE11484EE
                                                                                                                                                                                            SHA-512:EC95317CBCBA77D0F57709A75DF75EFABB553DC4B48C502529963B48DA7337CACD655E387DCEBC9F30BCE7BC34CB460825B232C3AA5376379B87CFDFFA0A80B6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:39.434 1d20 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/03/14-09:11:39.451 1d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):758
                                                                                                                                                                                            Entropy (8bit):3.962565035887569
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:G0nYUtTNop//z32m5t/yVf9P+KgkSnSedXHstXdmgG0:G0nYUtypD32m3yb+KRSnS/tNl
                                                                                                                                                                                            MD5:B2F145DC474D3E69E30DC7AD3252E784
                                                                                                                                                                                            SHA1:5E51F07A6A41B19EC8176CD4BD79A7771D59DD27
                                                                                                                                                                                            SHA-256:BAFC3C0D7094F6CB6AB157E8DE7D91638C1BFBE1D0CE5EE3B6FD8BD32F144C92
                                                                                                                                                                                            SHA-512:D92E23316D05EDB3A07F5F5ADC3A0C9F3741C7DB82E8B793676C1348C367E82C9628025389ED0679C5EABA742B0AA120099A6095BBCE1CEE0E8A1EC9F5627CE9
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_..........................3_.......:@.................4_......R...................20_.....m..A.................20_.........................19_......ort.................18_.....R....................37_......%d..................38_.......K..................39_......dV<.................3_........g.................4_.....D...................9_.....^...................9_.....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):299
                                                                                                                                                                                            Entropy (8bit):5.156995744386303
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:FEG3l1wkn23oH+Tcwtfrzs52KLlvEGdLq2Pwkn23oH+TcwtfrzAdIFUv:aG3YfYebs9LiGhvYfYeb9FUv
                                                                                                                                                                                            MD5:0DD5E729D0383E819C77AEABEC2D3F63
                                                                                                                                                                                            SHA1:71F94F7221FEE916E393D769E3DB5062E7B0EEC3
                                                                                                                                                                                            SHA-256:B1486A18F0603540500BDFAA562AFB61E5AEE50797D69F77EFC4F88C25AD8956
                                                                                                                                                                                            SHA-512:66273AF062BE1C37CCB545346923D806D6B28AA3FE031F43933482E66E14CA33E0176075CEB2AB7CC4C58B6896F45510E721930C3D62B14E43F0ED3D07C7D380
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:2024/03/14-09:11:39.407 1d20 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/03/14-09:11:39.424 1d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.01057775872642915
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsFl:/F
                                                                                                                                                                                            MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                            SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                            SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                            SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                            Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                            MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                            SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                            SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                            SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.011852361981932763
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                            MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                            SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                            SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                            SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.012340643231932763
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                            MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                            SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                            SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                            SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):262512
                                                                                                                                                                                            Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:LsNlNc4:Ls3Nc4
                                                                                                                                                                                            MD5:37B63A9B4E868F028BF09552AD26775F
                                                                                                                                                                                            SHA1:C02838FBD5D2A99951E56B6F04B73C1F5626BB55
                                                                                                                                                                                            SHA-256:E0597BF2FF865DBF92B7686EAE3A1C270E6EFE1897C379E07C5D89E7B8D78888
                                                                                                                                                                                            SHA-512:77F330CFE2E8EB564774EACF4AFA80EEA45DA437F45F47B1A68A45CAE686350D7B6516608AA7C54900F9F0F1254804378ECF424F86B4FC63CF7155B27973E0E3
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.........................................pk.0r/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.01057775872642915
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsFl:/F
                                                                                                                                                                                            MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                            SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                            SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                            SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                            Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                            MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                            SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                            SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                            SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.011852361981932763
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                            MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                            SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                            SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                            SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.012340643231932763
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                            MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                            SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                            SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                            SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):262512
                                                                                                                                                                                            Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:LsNlHmXKt:Ls3AKt
                                                                                                                                                                                            MD5:8C061D888715E14FC104872B4D00F841
                                                                                                                                                                                            SHA1:4B7CA97A07233FC9667CB0049367B8E12E513D8D
                                                                                                                                                                                            SHA-256:862F3B07054929B6DD8C2A925437A6C09E397A30F926498BD1A596546F3E79F4
                                                                                                                                                                                            SHA-512:E428CC076DCE349F7B84DE2866FB2E3131051C202B39174C54CE711AFB858E2B57382B7A584ABD62BE60C546F627DD34CC4A61B0D29499EB490DEFFD06AC53BA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.........................................?l.0r/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):120
                                                                                                                                                                                            Entropy (8bit):3.32524464792714
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
                                                                                                                                                                                            MD5:A397E5983D4A1619E36143B4D804B870
                                                                                                                                                                                            SHA1:AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
                                                                                                                                                                                            SHA-256:9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
                                                                                                                                                                                            SHA-512:4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):13
                                                                                                                                                                                            Entropy (8bit):2.7192945256669794
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:NYLFRQI:ap2I
                                                                                                                                                                                            MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                                                                                                                                                            SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                                                                                                                                                            SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                                                                                                                                                            SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:117.0.2045.47

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a416.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a445.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2cc5e.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f68b.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2fa63.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2fb4e.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2fb9c.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF319c3.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF319f2.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF392ea.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b9bc.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41b06.TMP (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                            Entropy (8bit):0.46731661083066856
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
                                                                                                                                                                                            MD5:E93ACF0820CA08E5A5D2D159729F70E3
                                                                                                                                                                                            SHA1:2C1A4D4924B9AEC1A796F108607404B000877C5D
                                                                                                                                                                                            SHA-256:F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
                                                                                                                                                                                            SHA-512:3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.01057775872642915
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsFl:/F
                                                                                                                                                                                            MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                            SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                            SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                            SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                            Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                            MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                            SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                            SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                            SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.011852361981932763
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                            MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                            SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                            SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                            SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                            Entropy (8bit):0.012340643231932763
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                            MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                            SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                            SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                            SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):262512
                                                                                                                                                                                            Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:LsNlPzVl/:Ls3LVl/
                                                                                                                                                                                            MD5:156D00FAFB0BF63A0342C463996DC41D
                                                                                                                                                                                            SHA1:158D0782B34C3F2902533FE2D4CBDE9655BFF405
                                                                                                                                                                                            SHA-256:92D626E4F5A18FFE800285AA5A593734A3D53DF53A4F7E7BBF23A22B7846AE24
                                                                                                                                                                                            SHA-512:0CFCBF62F5EE6F5465098DEF36A720D72FBFB57EEFA0BCF158CBBA9F5F7F52D03E765BC712B7304DEBC5905E4BA9BD4B4149293B2C000B7AB7E4E6174A45E909
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................[%V.0r/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):29
                                                                                                                                                                                            Entropy (8bit):3.922828737239167
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:2NGw+K+:fwZ+
                                                                                                                                                                                            MD5:7BAAFE811F480ACFCCCEE0D744355C79
                                                                                                                                                                                            SHA1:24B89AE82313084BB8BBEB9AD98A550F41DF7B27
                                                                                                                                                                                            SHA-256:D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
                                                                                                                                                                                            SHA-512:70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:customSynchronousLookupUris_0

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):35302
                                                                                                                                                                                            Entropy (8bit):7.99333285466604
                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                            SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                                                                                                                            MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                                                                                                                            SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                                                                                                                            SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                                                                                                                            SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):18
                                                                                                                                                                                            Entropy (8bit):3.5724312513221195
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:kDnaV6bVon:kDYa2
                                                                                                                                                                                            MD5:5692162977B015E31D5F35F50EFAB9CF
                                                                                                                                                                                            SHA1:705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
                                                                                                                                                                                            SHA-256:42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
                                                                                                                                                                                            SHA-512:32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:edgeSettings_2.0-0

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):3581
                                                                                                                                                                                            Entropy (8bit):4.459693941095613
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
                                                                                                                                                                                            MD5:BDE38FAE28EC415384B8CFE052306D6C
                                                                                                                                                                                            SHA1:3019740AF622B58D573C00BF5C98DD77F3FBB5CD
                                                                                                                                                                                            SHA-256:1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
                                                                                                                                                                                            SHA-512:9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):47
                                                                                                                                                                                            Entropy (8bit):4.493433469104717
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:kfKbQSQSuLA5:kyUc5
                                                                                                                                                                                            MD5:3F90757B200B52DCF5FDAC696EFD3D60
                                                                                                                                                                                            SHA1:569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
                                                                                                                                                                                            SHA-256:1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
                                                                                                                                                                                            SHA-512:39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:synchronousLookupUris_636976985063396749.rel.v2

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):35302
                                                                                                                                                                                            Entropy (8bit):7.99333285466604
                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                            SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                                                                                                                            MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                                                                                                                            SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                                                                                                                            SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                                                                                                                            SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):86
                                                                                                                                                                                            Entropy (8bit):4.389669793590032
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
                                                                                                                                                                                            MD5:03B6D5E81A4DC4D4E6C27BE1E932B9D9
                                                                                                                                                                                            SHA1:3C5EF0615314BDB136AB57C90359F1839BDD5C93
                                                                                                                                                                                            SHA-256:73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
                                                                                                                                                                                            SHA-512:0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bdcf1592-505c-4a1e-9b32-64158093905d.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):68139
                                                                                                                                                                                            Entropy (8bit):6.0794804869418915
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:3Fmi3bXYmyXInwT4XuJUHhQzsWwXk+sJXAzuwBZpBB:Mi3bXYvXInL+wZW5+sXAzuaZB
                                                                                                                                                                                            MD5:101EE811713296519A85F7CDD4FCB9DE
                                                                                                                                                                                            SHA1:6A50591476A6E1350155B45068959A35D84F50AF
                                                                                                                                                                                            SHA-256:0B777BB2C24E1185805E83162869C3467F3117873E1971230745C3B3A9160A80
                                                                                                                                                                                            SHA-512:A60009CC565924C89197DCB526E46169F8157B92B6DDD4EA048F168AC734051E1BA0A67183BD4F08AD40599F80D2B7049F13A2F834074879C1F604990F82DD4F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354877499479783","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d07f9f37-36ab-44ea-8d55-4b9a17312fcc.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):6820
                                                                                                                                                                                            Entropy (8bit):5.794845902992691
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:iaqkHfIFUmZW5ih/cI9URLl8RototMFVvlwhqe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akg2cneiRUGh66qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                            MD5:736D75525C7FFAE34A68A6A868703F29
                                                                                                                                                                                            SHA1:7C759BA9C38B7075D050B41210152F925485D1F2
                                                                                                                                                                                            SHA-256:37609188487AD5AF39C57D9969521A6551D7F224DA991082E798954FD58BC268
                                                                                                                                                                                            SHA-512:8F9CE149482159AC0FF161B0F48755383A2B7B765BE045C42679B99662F2DEB916F61DD4E19EE49CC95CEE9D1E273F49F44047E1657DF6826B167A9FE27F150C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC4BG8vJHQqSqWkcAKt7ax5EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAB1iODf13YxjY2WzHJTDJagMC8xTWQYQbeINXUG0JnkqQAAAAA

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d38c9e3f-4b3e-4f49-b447-a8238b44670f.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:modified
                                                                                                                                                                                            Size (bytes):27124
                                                                                                                                                                                            Entropy (8bit):6.072679163253485
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:3F5kruq4eVbAXbUy+I9QKsXeMQWonubZpG2e:3Fmi3bXYVOwBZpBe
                                                                                                                                                                                            MD5:3804C36CF780F58492AC26F77C9013F2
                                                                                                                                                                                            SHA1:F9917EA45783B564E3FBEF1C3396D16C9C30A55E
                                                                                                                                                                                            SHA-256:FE12F5E024DCE7E9079699781A6E1077C721FB7124D6C1294F000CB74EC88247
                                                                                                                                                                                            SHA-512:9B8411D7BC7CEAC191A19A28FDE215AD2C7726D63DF473E4CBEAA1873B6297783DDE950C82B52246645569E537096FE0EDE30B4CFE4CD74D540ED846D43B62AB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354877499479783","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d391fd32-ea9f-42d0-ac83-79e228672c99.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):26021
                                                                                                                                                                                            Entropy (8bit):6.070103838668123
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:3F5kruq4eVbAXbUy+vcKEeMQWonubZpG2e:3Fmi3bXYRwBZpBe
                                                                                                                                                                                            MD5:1E2E6CE614AFD7E017CA0EA68FD4FEF8
                                                                                                                                                                                            SHA1:683F20927FAC1F62D165CB6AAB0B11C831A289EC
                                                                                                                                                                                            SHA-256:D48F74D9D90467A321E34276D9756D0056F389BDEA96B9739E3E3C6F1914495B
                                                                                                                                                                                            SHA-512:8B97D0A34D0EE135E8BAC5FCBCB30FA3D66882DCF5863D7F3E0CAF726FEF256C9AACDF82EAB8D3FEF256945958BDD295F775DFB71F5E0ECD554C20B5659C27BE
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354877499479783","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ddb1550a-b4da-497e-9a59-584c72371789.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):27124
                                                                                                                                                                                            Entropy (8bit):6.07266620090743
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:3F5kruq4eVbAXbUy+IjjKsXeMQWonubZpG2e:3Fmi3bXY4OwBZpBe
                                                                                                                                                                                            MD5:7651AC022F67907DDC9499D65378E811
                                                                                                                                                                                            SHA1:5C2D555042DF3122F75880CD895E6F69DFB4E391
                                                                                                                                                                                            SHA-256:57D3B473202618E6E0BFEA9DE347CCA99C8558FB672CD6F5259E17B71CF9B885
                                                                                                                                                                                            SHA-512:83DEF6D86B20FB5A42688C0942F15EE2E49B2681CC77774129ECE1A67737566E2DE793F43B8C8135569504FF18F44FD2477EF0D72927B91C1A1FEEBBADFE4CCF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354877499479783","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{79BADE0E-E1DA-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                            Entropy (8bit):2.8824875718967036
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:d7237G7j670707V7J7G7g747i7h7hI797DI6il7yha:c6iIha
                                                                                                                                                                                            MD5:13FB4F1674975D4C2D988DEF603D5AF4
                                                                                                                                                                                            SHA1:CDA7638B51775C4724A807B6BF2C5E831AF28661
                                                                                                                                                                                            SHA-256:86F56E08DE97295E6434299E0F2CFE13D6581A12A94E5E293F7CB05565FE8792
                                                                                                                                                                                            SHA-512:23BA0F24C2040A1DCBC329BA14A50D749BA2A5D4A00F6A23849F5C2BE9D7FB83054FD767AF541764DE45B8BDCD142FD1A883A6FF6DC4B9B5980F035EA83DFB68
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................P.\a.u................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t.......................................................................................................P.......O._.T.S.D.9.6.6.e.d.r.h.7.h.G.M.L.O.z.0.u.+.o.V.i.A.=.=.........:.......................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{79BADE10-E1DA-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):5632
                                                                                                                                                                                            Entropy (8bit):2.2145408612102564
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:rXGDGxB9lj8FZys0bKvqy6yEyvy5DlsN5Acb9lj8FZysXvqy:rXGSxZ8FZnoKS9LYu0OU8FZnXS
                                                                                                                                                                                            MD5:5D833AAED6E92E22F74A36495E0DB66C
                                                                                                                                                                                            SHA1:B471975A756151656071C22D0307C9ABF0F7AEB1
                                                                                                                                                                                            SHA-256:CB37C6702451A5DC009FE76C2977727871B09FAE12A95F00E94B493FE31942AA
                                                                                                                                                                                            SHA-512:599C8F8833841E884739E869A7767C5F858E5F94C061413FD163609B0DA5737F29830A64847D1BD5EEECEB04D0D45DEE7AF3CC0C8E148BB7BFEBC1A71DDF5A33
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................P..G.u................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{79BADE12-E1DA-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):5632
                                                                                                                                                                                            Entropy (8bit):2.2112493042757335
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:rJiaYGx7H79lj8LZyGaKvqy6yEyvy5DlsNUAcb9lj8LZyGXvqy:r8aYGx7X8LZNaKS9LYu09U8LZNXS
                                                                                                                                                                                            MD5:EF4A118120677BC73299C938965F765D
                                                                                                                                                                                            SHA1:C106D0EFBF8441EB8E7EEFE3C098469A4B6F05E8
                                                                                                                                                                                            SHA-256:F92CD716088B41F5C36E5995B1E5D7A235D4A718BFF8F7017D97F2885EB16DE2
                                                                                                                                                                                            SHA-512:3904354C2C92089A375964A2FD18EC42797DEC09FF64EB8F09EED37554D27CC42FBAA89EEE4298708D3C0F0BE591F0B46804C10B38DB4C52D27DCCC21F16530E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................`,.L.u......@.........K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g...............................................................................................................T.L.0...................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{8EAA4E38-E1DA-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):5632
                                                                                                                                                                                            Entropy (8bit):2.210248410366626
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:r0PGDURH79lj8TuZyguuKvqy6yEyvy5DlsNUAcb9lj8TuZyguXvqy:r0PGIRX8TuZNuuKS9LYu09U8TuZNuXS
                                                                                                                                                                                            MD5:EB04E276C4E335BACECFF0EC04FA824F
                                                                                                                                                                                            SHA1:9B0FFF7AC94570026FDCCA6BE28DBA0FDE651ED9
                                                                                                                                                                                            SHA-256:3F1DF3F5075D8B855468037C97D5B1C046CA3861850CD7B0BF9D138645FAD1FA
                                                                                                                                                                                            SHA-512:4F4DDA7BA3230EBA938E6788DB309F5555FC7537DD4E5C95DC4E87692A7D8F0F5C5265A95B74E3FFA0BF098A5C3A4406FF7A89B02EC64B6193C2B2A4E62D0E29
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................P..R.u................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{8EAA4E3A-E1DA-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):5632
                                                                                                                                                                                            Entropy (8bit):2.2058352948940634
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:r8GD2RH79lj8sZyFuKvqy6yEyvy5DlsNUAcb9lj8sZyFXvqy:r8GKRX8sZeuKS9LYu09U8sZeXS
                                                                                                                                                                                            MD5:03C0824DF010CB35696F38E130440F59
                                                                                                                                                                                            SHA1:3C88668E51412E7544F4B51976FE4F1273D15FAB
                                                                                                                                                                                            SHA-256:78F43A4A412DF06B941E2B6344F8183D75A1959ACADB3C256EC0F68F247FCD0C
                                                                                                                                                                                            SHA-512:884BB6DF356533A68B7E663B655C5381052BD892D4CCE5EADC11B5F34235AB60DBF90027E83E30847193CF7B7778C0DA2BA7029F89013AADE0073D6DA88342DE
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y......................................................................................... ..U.u................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{9624D4FB-E1DA-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):5632
                                                                                                                                                                                            Entropy (8bit):2.211864382767585
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:rmGDnRH79lj8N8Zyc8uKvqy6yEyvy5DlsNUAcb9lj8N8Zyc8Xvqy:rmGTRX8eZ8uKS9LYu09U8eZ8XS
                                                                                                                                                                                            MD5:35EE317F60BB6CE8EE7C941F1AFE1715
                                                                                                                                                                                            SHA1:61897993CF54DEE3448EC015E7E988CB6957C3A0
                                                                                                                                                                                            SHA-256:232E5C1A632F1BED4A2FDA4BC5702E03717E521D54D04A9DC69B8C2321C80099
                                                                                                                                                                                            SHA-512:7ED6EC2AFC83AF3DB87303F2391F7E818CED5D92AD3058F80F10361DAD408953E41833088E4ADDD8821753E7EE2FA2CCF53F89072724FA7D904C7C023D9F53AC
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................@s<Y.u................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{9624D4FD-E1DA-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):5632
                                                                                                                                                                                            Entropy (8bit):2.210820787690432
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:rJlXxGv9lj8jZyL01ZKvqy6yEyvy5DlsNUAcb9lj8jZyLXvqy:rXhGb8jZkKZKS9LYu09U8jZkXS
                                                                                                                                                                                            MD5:7E3B085A72B838B8A00B1A4EA5DF146D
                                                                                                                                                                                            SHA1:37ADE011969629D177C2B208D652D92BE97D91C0
                                                                                                                                                                                            SHA-256:4A78B8FF48A410CF2288F8FE5500243F37B61FE5677E1359E890EBA7D0914CCD
                                                                                                                                                                                            SHA-512:D7EF8D6E9CE41A87927489151A9C350F2B37FA76EC290639167A6F92CD14EE0675F11E0E08D0CC55FD2C8D332872E901A91CC1A59BAB101A9ABEB033D6854062
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................p..a.u......@.........K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g...............................................................................................................T.L.0...................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{9EEA2AFF-E1DA-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):5632
                                                                                                                                                                                            Entropy (8bit):2.209673997094168
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:rJMjxGv9lj8HZy/01ZKvqy6yEyvy5DlsNUAcb9lj8HZy/Xvqy:r2tGb8HZ0KZKS9LYu09U8HZ0XS
                                                                                                                                                                                            MD5:74801A4A4E50143FBAA7E9085AB2D4F4
                                                                                                                                                                                            SHA1:46D489D1290F46A228B39FCABF9B5A829C00F731
                                                                                                                                                                                            SHA-256:283C1D7F26EE785B9D3E5981B7735D6F11574066CEB66B778C3DDB2C97E23F09
                                                                                                                                                                                            SHA-512:8300AEE45D6553F9EC09C5189F4667EED9CE5DCCC04407A54E0A8914E34329BE625361D20DD372D4514FFE59836B7B53BD4033FC3F7F24890AED9475021F3619
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..........................................................................................x.g.u......@.........K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g...............................................................................................................T.L.0...................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (313), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):355
                                                                                                                                                                                            Entropy (8bit):5.096363482644938
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:TMVBdc9EMdLD5Ltqc41EwUH914MUBhaTD90/QL3WIZK0QhPPwGVDHkEtMjwu:TMHdNMNxOEw+YonWimI00OYGVbkEtMb
                                                                                                                                                                                            MD5:AAC4A036064004BDFB8E0E684D75713B
                                                                                                                                                                                            SHA1:0843A732A2362EB8080EA6349F2BEBE2F93BEA4F
                                                                                                                                                                                            SHA-256:BE6DD20FCF66AE23ECA01AD4518F78E793C02BEB7E86EADF976247DD65A1A6F1
                                                                                                                                                                                            SHA-512:AEFA81EBE9083CAB00FC1E86DC30EC27303AC25C24BC58194CB1C472A0E0028DF22CB3075A2D0A56E3A229E5992E4D30B226A98206B4F54709847864EEF76ADD
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x481b1aa3,0x01da75e7</date><accdate>0x481d8b77,0x01da75e7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):353
                                                                                                                                                                                            Entropy (8bit):5.10654332988222
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:TMVBdc9EMdLD5Ltqc4fLGTkLcF4fcFaTD90/QL3WIZK0QhPPwGkI5kU5EtMjwu:TMHdNMNxe2kLNJnWimI00OYGkak6EtMb
                                                                                                                                                                                            MD5:9E373C3C4A8EAA6273151E6B2D5AF755
                                                                                                                                                                                            SHA1:DE6BC942CDCC34EA4676AE993C75161B0EE7BDC6
                                                                                                                                                                                            SHA-256:F60D938F8726FB258340A1E1AC0BB14FF0F742E5700BC4D2694BB9644ADFB027
                                                                                                                                                                                            SHA-512:989B1687CC5371CFB5F98E03EC035C10D742EDD102B0D5842CDE628097561C73AC0E79485C7F525193676D48D1E47C29B3A1D0E7D8E6672C214264D7829B7D2B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x47f4a701,0x01da75e7</date><accdate>0x47f4a701,0x01da75e7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (317), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):359
                                                                                                                                                                                            Entropy (8bit):5.14450892743645
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:TMVBdc9EMdLD5Ltqc4GLwUDjgBs4MogaTD90/QL3WIZK0QhPPwGyhBcEEtMjwu:TMHdNMNxvLwOEyoZnWimI00OYGmZEtMb
                                                                                                                                                                                            MD5:B19DE7EB8131CF426262540E4B95CB43
                                                                                                                                                                                            SHA1:119132F8A9D02BD76D2AA2B1E876356857998BFC
                                                                                                                                                                                            SHA-256:DC2FA96861096955AD7AF71D4BCD9015E114D9EA921ECA2BDE03C8D0A7B21381
                                                                                                                                                                                            SHA-512:20CD0D32F2F6205B97FB46258610926894B098CBC032A7A97C60F4EC612C569A5615996723D2053239E445379E623216A0C5507EBD16704D2558FF301A190036
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x481f6064,0x01da75e7</date><accdate>0x4821d140,0x01da75e7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (334), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):376
                                                                                                                                                                                            Entropy (8bit):5.1761261352023835
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:TMVBdc9EMdLD5Ltq08eDPOOKaihM4z+Bs4f+4HaTD90/QL3WIZK0QhPPwGcE5Ety:TMHdNMNxtDPOOKaIz+h+46nWimI00OYk
                                                                                                                                                                                            MD5:C61BDBA1FCF5306604A251075BC6A55C
                                                                                                                                                                                            SHA1:036DD4B57C4FC4BFD6C19DBDD0CF24E7235478A7
                                                                                                                                                                                            SHA-256:52FA23A22E7FF23EB71508CD7CD42BEB6E172EE3DDE2BF7EF48496EF8CC618AB
                                                                                                                                                                                            SHA-512:9FA29FBE023DDEEEA6D3F324190EAD1A4EBE6500511DEBA249DF2023AE2EF8413ABDC9AB4D55421AD4E2F7DC0C4F6C259868CCEC2E6661692A6F982B022884C7
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://go.microsoft.com/fwlink/p/?LinkId=255142"/><date>0x47f8ecd4,0x01da75e7</date><accdate>0x47fb5db1,0x01da75e7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Bing.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (307), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):349
                                                                                                                                                                                            Entropy (8bit):5.087780675924924
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:TMVBdc9EMdLD5Ltqc4Jw85H4MNVYsaTD90/QL3WIZK0QhPPwGgE5EtMjwu:TMHdNMNxiwSNVYVnWimI00OYGd5EtMb
                                                                                                                                                                                            MD5:4A2FFF53521F18960EB25A5AEB3AB93B
                                                                                                                                                                                            SHA1:1DBFDD675E1FDBBD4503A00D02B8C96B5C59B911
                                                                                                                                                                                            SHA-256:D7ACDAB1CC318769BA1BF6C94AB4C302BF81EBB6EE04BFCD4E8704506C0A1308
                                                                                                                                                                                            SHA-512:BEE92595C3E746A656D02BD062D14334031F9E9D9B1E62C62E9B5B8E0D84F168EC0D46930AE709270B8C63F5D275153DBEA0FB849F9AA209568FA46B12AEF726
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x480c7500,0x01da75e7</date><accdate>0x480ee5cf,0x01da75e7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (313), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):355
                                                                                                                                                                                            Entropy (8bit):5.168778230760135
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:TMVBdc9EMdLD5Ltqc4UxGwwSgi4M43aTD90/QL3WIZK0QhPPwG8K0QU5EtMjwu:TMHdNMNxhGwwSg84qnWimI00OYG8K07/
                                                                                                                                                                                            MD5:05737396D63BDB19BE5B05869FF97B5C
                                                                                                                                                                                            SHA1:58EC57B5DBD04168D4E00C41B843D879CA6BCA5A
                                                                                                                                                                                            SHA-256:D29B25CCF3614B09098B0D195AD235B65FA5521176882A5F1DCC70674D1D2465
                                                                                                                                                                                            SHA-512:EAC3743074CDB0620136BA1116F843E0403DE7A4B5AC9E0F8D23967A5B0D40ACBD55454E782DE073938BD62E1F3798898734A26860784A2D704D20D3AB553114
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x482442c0,0x01da75e7</date><accdate>0x48261718,0x01da75e7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):353
                                                                                                                                                                                            Entropy (8bit):5.130509511905076
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:TMVBdc9EMdLD5Ltqc4QunwUT74MUdR+iaTD90/QL3WIZK0QhPPwGAkEtMjwu:TMHdNMNx0nwiEonWimI00OYGxEtMb
                                                                                                                                                                                            MD5:C758DDBC7609181BC6027BC1D8F5E72E
                                                                                                                                                                                            SHA1:D51DFF0F7F97984C39499659A706A8E9A78E4D4C
                                                                                                                                                                                            SHA-256:BDF34C369B213B36895EE326150CF6E500D095194E0D36EB0ECD9D892B6430D0
                                                                                                                                                                                            SHA-512:1E9B4CCC3EE4A7988B5E53D63603C9BA606AF2D29B5095B5C72EAC8E919CC3BB3861EB6AD22BD93A96C4FAD066F2C3489CA8A41BD76F5BBBC9CB6176639289A9
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x481638ba,0x01da75e7</date><accdate>0x4818a9b8,0x01da75e7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (313), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):355
                                                                                                                                                                                            Entropy (8bit):5.164480203221552
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:TMVBdc9EMdLD5Ltqc4oTwUKlYs4MUT7aTD90/QL3WIZK0QhPPwG6Kq5EtMjwu:TMHdNMNxxwHYyFnWimI00OYG6Kq5EtMb
                                                                                                                                                                                            MD5:35C8BE9FDF80A7002989FE774881803E
                                                                                                                                                                                            SHA1:406E32227DEE42E01C52D48E8671220125F6D63F
                                                                                                                                                                                            SHA-256:F5F1A18E97518E2EBBD0C0217D17A16CC73ABF443E32B9B2114D19457B7F7B6E
                                                                                                                                                                                            SHA-512:8FE5BC6F4685FDCA1388F237CA30C8081BD33D552AA114E05528270A94DC19BE8942DDF60F5FE8CA2E08A6C374ACBFEC3D7E629DF3993B17971D33FCF2C8DD82
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x481156ed,0x01da75e7</date><accdate>0x481638ba,0x01da75e7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (315), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):357
                                                                                                                                                                                            Entropy (8bit):5.118993453499655
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:TMVBdc9EMdLD5Ltqc4YX2nwas4M+gVdV1aTD90/QL3WIZK0QhPPwG02CqEtMjwu:TMHdNMNxcwayNVMnWimI00OYGVEtMb
                                                                                                                                                                                            MD5:DC07BF18624C47720643D8E6BAFA4B1E
                                                                                                                                                                                            SHA1:EFE86070B4B255D6FFFC772D9C47D3DE5BDE0C2C
                                                                                                                                                                                            SHA-256:0AD530D9DA09AAF893455555C8E2949E0C8B4E64E098CEE3A84E9F56E05DE58A
                                                                                                                                                                                            SHA-512:939A20E67F221313EC1BC5CBFBCE4D763580FF6E2C8523737FCFD8A8050886F8C9692890CF16841AA74A02E6508A1B715F5A70B273FD185A804D659D0CB019DD
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x48003fe6,0x01da75e7</date><accdate>0x4802b0ca,0x01da75e7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):353
                                                                                                                                                                                            Entropy (8bit):5.114073668380411
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:TMVBdc9EMdLD5Ltqc4Inw+s34MkOBsaTD90/QL3WIZK0QhPPwGiwE5EtMjwu:TMHdNMNxfnwftBVnWimI00OYGe5EtMb
                                                                                                                                                                                            MD5:F335A168D3E48BE188D457E76254607F
                                                                                                                                                                                            SHA1:1AF36EF543390C221CB07C487D9ACDA43D46A998
                                                                                                                                                                                            SHA-256:978ED50EB257B41CC3EA9BD8FB3CA5A5B1A3C2BB842A97D1DD6FF0926F74DB4E
                                                                                                                                                                                            SHA-512:7B4F8CD0188997C641ED1871DAE1A84F6E934460C51C47315020CCEE3EBC75EA107C899B6BEA2228D6DC7D0EF1B7C9BDB4C4B3DBD7CEB46D51F9050BFE12A2B2
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x480521ae,0x01da75e7</date><accdate>0x4807927d,0x01da75e7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\00h0umm\imagestore.dat

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):866
                                                                                                                                                                                            Entropy (8bit):7.1709150924078555
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:kUvF/6easyD/iCHLSWWqyCoTTdTc+yhaX4b9upG6:kUt/6symC+PTCq5TcBUX4bY
                                                                                                                                                                                            MD5:F1EACEE8850E9B42A6A3AC7FDEE94035
                                                                                                                                                                                            SHA1:A18A2DD7B390AE19AE606EB0F85A727D07C85D3E
                                                                                                                                                                                            SHA-256:CA103150F44F5634E0CBEE6A46BFA59850073559004B39732D135494F8434B9D
                                                                                                                                                                                            SHA-512:D7E2A31DB292B7DDC1880814E95DA7FE9C0CC9D8A8DFFF5711415A929B54E95D1E0A50E0A736A70B3989DB3C903994485D3DC9973281C2F8BF59D1257779A460
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:..........h.t.t.p.s.:././.w.w.w...m.s.n...c.o.m./.f.a.v.i.c.o.n...i.c.o......PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D.*.M.*.............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`. ... ...........M..e....M..e....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2278
                                                                                                                                                                                            Entropy (8bit):3.842966583401791
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:uiTrlKxrgxy9xl9Il8u/YA5kLvfIVLcYV7t+IQl3RIzd1rc:m5ZYyskLXIBZxt+vtRIU
                                                                                                                                                                                            MD5:F1491432A55F541DA3D5639E7769D964
                                                                                                                                                                                            SHA1:E1CBA952BDDF0EFFDAD5FF660CD8AB3EE157289C
                                                                                                                                                                                            SHA-256:363AA990A9174C3CD4B416B17A2C8D045AB180F86949E8F53AB76364ECE31A59
                                                                                                                                                                                            SHA-512:9FE566ECC803E602A280BEC4172D51A79D7AFFE989C2572608044233B4633913A81028AD37C452773AA6E2F2F16D599D573EA3D5DA71A5E188E74F78071109F0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.E.R.t.o.O.9.1.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.u.A.R.v.L.y.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):4622
                                                                                                                                                                                            Entropy (8bit):3.9978267924218773
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:oYysYQblYbFh9b1xX2AVxw4B3UuJEvlisy8legNN:otUlqr9n2AxwHuJEvbeA
                                                                                                                                                                                            MD5:0654C9CBA617BE54E7918374F76D485A
                                                                                                                                                                                            SHA1:B2E0BEEA7B2AFD4A256815084F3FB4B5BBCE0D1E
                                                                                                                                                                                            SHA-256:8AC1F9AA0C8631A38F39E4B8983853E98D9624220377746B97168D595427A6C1
                                                                                                                                                                                            SHA-512:9F5AE5EECB49B59DCF6FF58787F7657C1287C946157529E94069E4F49298B4379FB5B203EED86F6D0329E0313A39B0C05D140A96D059E19005EBBFE6B8136E54
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".m.i.q.U.h.u.d.1.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.u.A.R.v.L.y.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\favicon[1].ico

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):4286
                                                                                                                                                                                            Entropy (8bit):3.8046022951415335
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
                                                                                                                                                                                            MD5:DA597791BE3B6E732F0BC8B20E38EE62
                                                                                                                                                                                            SHA1:1125C45D285C360542027D7554A5C442288974DE
                                                                                                                                                                                            SHA-256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
                                                                                                                                                                                            SHA-512:D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\favicon[1].ico

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):758
                                                                                                                                                                                            Entropy (8bit):7.432323547387593
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:6v/792/6TCfasyRmQ/iyzH48qyNkWCj7ev50C5qABOTo+CGB++yg43qX4b9uTmMI:F/6easyD/iCHLSWWqyCoTTdTc+yhaX4v
                                                                                                                                                                                            MD5:84CC977D0EB148166481B01D8418E375
                                                                                                                                                                                            SHA1:00E2461BCD67D7BA511DB230415000AEFBD30D2D
                                                                                                                                                                                            SHA-256:BBF8DA37D92138CC08FFEEC8E3379C334988D5AE99F4415579999BFBBB57A66C
                                                                                                                                                                                            SHA-512:F47A507077F9173FB07EC200C2677BA5F783D645BE100F12EFE71F701A74272A98E853C4FAB63740D685853935D545730992D0004C9D2FE8E1965445CAB509C3
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D.*.M.*.............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\5EQPBFWM.htm

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:HTML document, ASCII text, with very long lines (58200), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):191148
                                                                                                                                                                                            Entropy (8bit):5.462440657364991
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:nIuhqUwMa1ar2FtZmVL3GDoTt8GxHLiE25AglWG4g6U5NgW8uaw3duORA/FpNnDW:Iu0zNFD4LWDoRLk/h5NyhwNuORAK/xYU
                                                                                                                                                                                            MD5:855BA65819DFEA20E9C651C220EEF4CE
                                                                                                                                                                                            SHA1:5771AFA65397D60DCF794EB9D93B0C01B139B656
                                                                                                                                                                                            SHA-256:C0472F48043C53C5605895ED14876BE8D94E16D08EA90CBEECA15E0A7342F9C5
                                                                                                                                                                                            SHA-512:66CE35B7313B96C3811DC90F43081090E57E2076D99C82F99C37AC14F51A98D5009E6FB4A0CC14F6FBE93DC5B9B3464F7153605C9C301C49B1A98B1039851FCA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-tat-msnvserp-t,1s-msntovserp,mms-sc-sc_con1,prg-c-visser,shp-xap-gr-ps,prg-sh-carrsb,prg-sh-enitlea,prg-sh-enitleactt,prg-sh-genreco,prg-sh-genrecocreative,prg-sh-genrecosubkeytest,shp-xap-gr-noux,prg-1sw-sa-qryannt2,prg-1sw-sa-ltmig0311t,prg-1sw-saql2restrictedt1,prg-1sw-sa-l2prerelvft4a,prg-1sw-p1size-inf-wm3,prg-1sw-infiriv,prg-1sw-p1size-inf,prg-1sw-p1sizeinc,prg-1sw-pagefilter,prg-1sw-rivactsec,cg-rr-ctr,1s-eaop1,prg-sh-badgewc,prg-fin-chl,btrecenus,iframeflex,prg-adspeek,1s-winauthservice,1s-ntf-hisenc,prg-1sw-samhibrnc0,prg-cg-uxprod,btie-fancy-img-t,prg-ad-ai-imgf,1s-fcrypt,1s-shp-xp-ectocnrich,prg-sh-ectocnrich,prg-premier-pr1-t1,1s-xapentprong1,prg-1sw-pro2pre,1s-p1-bnw6,prg-1sw-sa-bnw6,1s-ntf1-fyrvt2,1s-wpo-pr1-ifpsc-efy,prg-1sw-brnsspotbd,prg-1sw-fynp,prg-1sw-sa-fyrvt2,prg-1sw-ccl2-gbg2,prg-wpo-pnpc,1s-wpo-prg1-cnsimplify,1s-ntf2-fyrvt3,prg-1sw-sa-fyrvt1,prg-pr2-fy2tit,prg-

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\AA1md5qf[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 300 x 157, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):68226
                                                                                                                                                                                            Entropy (8bit):4.959739580335679
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:7inNt2J9v3/sNjhiVb2f1EdPBq2y+Ce7x6GrheHNBnh:uzesNtiVbS1EeKXlP9i
                                                                                                                                                                                            MD5:D758A4D3C931CAD8EF0B73C7D69AF611
                                                                                                                                                                                            SHA1:3A6BB6F8970AEEA8B5083DACDD6821D33C30F28F
                                                                                                                                                                                            SHA-256:E8D0BEA18834B33660AEE69D84FA9D81C90F14A81A2DE0A9FFDDF4B863BF0B75
                                                                                                                                                                                            SHA-512:B2548804638C76EA28F6FB7F7667F014E4E7D44C3735F6096A85EA9AA9CDFCAA27F4C5EFF2AB8FCEF20EC150BE2F3276AADF2DEF798A747AB4B0FB6C7A1C0C20
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR...,...........E.....pHYs..........+......IDATx....&iU...}o.{.v.t......!..+H....0..UTTt.U?"."....u./......"A%..&....nw.|...~.Su.N3CX..q..oU=....s.s..D..6.#.@;.g...XmhG...v...#...=.1..lG...G....=hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{.....y<..<....pz.0...L....h..@;...#......N'.....wFL\..../G..?.1X.N..c.+d.U.....6...v.>..h.....F..h..zJ..G...C.).%.......I......lT... .$.v2........&.0k..<..q../..#p...........Nt6?=......:.N.K..X2.V..q.&9..1~A..9.Z..u.+.....9_.C.....-.js.^..`9:q.Ck.*G..iG`m.Z.Z...N.....,.S...U.$9...N.U.V..p@.L\W..M2..Y'9..\.z.F."6..6.`.z.p.K.l8.K....!n.bf..%.&...:....d.^sR.b..mr..v..c.@.Xw......K.R.......z..[....ED..qLp.#....IP|$TpX....'.....Yw.s._...+.(nV..:]..V.....w...A.....<]..C[.......M......#...]<..x1.N@..1@.dtGv.^.r.X.. .pbd

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\AA5DAVD[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):354
                                                                                                                                                                                            Entropy (8bit):6.851574657438451
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:6v/lhPmNpkB/6TogjnDspd/5eG5S7DpwKq0euaqg73ksgXQwleNTpBSp:6v/7uNpkB/6Tog8b55k5q0xKkjNsdrY
                                                                                                                                                                                            MD5:DB2E1DF623C8DB811AC8284932914CE6
                                                                                                                                                                                            SHA1:C13272524E195E216CEF4599109BAA04C25298F2
                                                                                                                                                                                            SHA-256:6B9A1770191B8F4D2653A45BCA237ED9827229433C7F7EEE55AEC14120536E65
                                                                                                                                                                                            SHA-512:4557623E9F729A20688E59406D5F36049A931FA3914894D6AB259EEAD0DE165BBEA29EBC275845B7E346BDC3334430518D0CF8C92FFE88E323118CC4BE46BDCA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR...............h6....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b|,..@.`b ..B.,..')....Y..O....1rq.}....= A....&..&_A...&....q...U.E.*X.Uy..j.gO.:.EF...=@...g.e77.y.$......Y.na...g.)@Y...]@.O...v.YP......=..f..R..]g...}..T..:..@..@G.m.......p.+4.h..W.Z.@.....!A.2.@G.y......@...)....4....E.fc..x.....IEND.B`.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\AAsvT3F[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):782
                                                                                                                                                                                            Entropy (8bit):7.558724821214522
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:6v/7wynO3/0sg7EgmhMEVek5Kajub6agf+AgKeW0j4kt0tcKiN5ni:XyO8/EgmXVeEKQuwf5t5FiKIi
                                                                                                                                                                                            MD5:0AB2C84C15C308F3D735D74417AF27BB
                                                                                                                                                                                            SHA1:AEE2D3BEC26BCF706CC92BEDAA81C30F422512BA
                                                                                                                                                                                            SHA-256:D6FD425BFA06418F87594F7FB1486734777EF6655442296EAB3B768287BF745D
                                                                                                                                                                                            SHA-512:CCF2A53DABD4CA7CDD4BB5AD6CA1144E2A421916846595F757F4C92DEF232AD23D7192CA5C82AC2EB97E0CD781B26EB3EEE4A3A5FCF05C31691C7D404F006428
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs...........~.....tEXtCreation Time.9/26/17T#......tEXtSoftware.Adobe Fireworks CS6.....gIDAT8...K.q..?......5u6.....D..MVX<.!...(t.VJ....g..E..X...j......5........r.;......;..;<..A.p.)...177W...y..F...mc...X.)%.N.]....x.G............+.....j.eYh......e...G(.bxx....*...d...1677..r$..3.4Mckk........J.b.H...n......*.iR.VY\\dhh...)...H)1....A...(....y..2......*.d.t:......sxxH$..........J%..,KKK...r~~...H).}.EQp..V....(B.<..mr...e...L..&.J....@..8.C.^gzz.L&C.VC}......B.:.....>..T"~=..l.h.?.vw1z..h.....iJI...._..F.i..!.DWU..#.@.4........q.f.n.....X.+j(..|......W.....7.vQn..?....".F....8F.}.y......yWb..9`.x....x..<..<:"....#(..D"(...Stt.!~..+.v.....pE'8.......<.)Q.&.u...].+..k...t.?.2.........IEND.B`.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\AAywOab[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):18737
                                                                                                                                                                                            Entropy (8bit):3.2627728137161602
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTKkEWmHjxNXrNXNsc5MVNkvBs6c3:bSDS0tKg9E05TKk615UNa7G
                                                                                                                                                                                            MD5:030939BCC37975289457F6A19A301A35
                                                                                                                                                                                            SHA1:89D55A45787FE9DD547BE9CD1D97C9A8F641E338
                                                                                                                                                                                            SHA-256:D5D6DF229AC67CDE4B39D275955E4A279BBD7F922855D10B44F5701E6AA3CC64
                                                                                                                                                                                            SHA-512:21973881EF4C8EE777A1EA5570418439DB32EEF3B83B1FE468749B5C7669B82B19DF6568531C0155ABA929A2928E88DCDB654E1DE8F3966228C279E91C120E9E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\AAyxkRJ[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):18737
                                                                                                                                                                                            Entropy (8bit):3.2844151735912424
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTKkEWmgCxNXrNXNsc5MCrdL:bSDS0tKg9E05TKk6x5R
                                                                                                                                                                                            MD5:0E24DBB269909FB843B94057283D62C3
                                                                                                                                                                                            SHA1:1876120A624E3A7EF745C9EB0E05B5E47FBBE657
                                                                                                                                                                                            SHA-256:0952BFC78774D1ABF4729092EFDF61B96FDA8BA06F47E0A95A7347A5A41BF0C1
                                                                                                                                                                                            SHA-512:0E4F02B8C05BB2BA7E6924025A2222EE3583BA60DEF3FF48AF3A46669E5ED396CC5F7A90B9858B7CE0DB5C7E3FE7B50D6C9877F1F8DDE2DE7C2D8A6AE72B2205
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\BB1jPVB3[1].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 640x360, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):13262
                                                                                                                                                                                            Entropy (8bit):7.947347064611274
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:WXks5qZ2rpyUGnkojwC557cvn3tamumGVfJ9sixLBtwlyZ+jjQCW4YDN:Wks5NILn557En3tamE/1ntwlyZlxdDN
                                                                                                                                                                                            MD5:AACAEE68ECA1E6589FF10CE8A31D0ECC
                                                                                                                                                                                            SHA1:1F39607FA2205896ADDDFA67D840BE8E7565B709
                                                                                                                                                                                            SHA-256:1571DBD55A17F36C3E38032F8B15B58C5F4407706323A0481C158C47D763CF4C
                                                                                                                                                                                            SHA-512:0FFE1F32B3A701EC0D4B269CFB3DC5CDAC94BE5E2526A03B36537D6F310395A3F00AEB6595EE7ABCE08E58C16002C8C57A85EECF0EBADF8F96BF64DEA516839C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......h....".......................................;......................!1...A.."Qa2q.6r..#&BR...$35C..b%................................ ......................1.!A.2Q"............?...1|..s.Q...1....R..?q*.,...'.....o>H.[.f...Sc .^.*t.!...:.=...-.....\....d.@.o-..?.,....B...PR.&....@...$k.eq.2>.....yG.$..b+7. .IJ4q$.mY.h....%..-..C$h....-.-.!).<..{......G.{g..u..Y._...#.(...D'.Y..B.qjC...)W.!..T..J.h..$<cs$.Ea%vs!.Q..;+5..ME.62..&.<..E.../.tj2.M... QQF.B...Ci..*..+.:T..N.:.3..(.@.W..{.?..Q.e...x...vJQHeZIG@..o.{.sU#R...=...5..|X...L.'c.W...t..+.W.,.3C.S...#.f.!.n".J."W..E..S...Ejg"....+.KD./.+..z&EK.0E.f.._..!..B..$S7H.. c&...W.-......'{..ZC..3.*...X.h.{...b... J..)..*..c.......X.t.d....l..2../.Rv.@..)!.....kD..t..WL.@.{......m....>..).E.I{.*....:..(..H1at.i*..[...........v..[..y.#?Lz.I.....H....I..Wc9Z.r...

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\BBACBCB[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):18737
                                                                                                                                                                                            Entropy (8bit):3.2062466761310993
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTKkEWmIKJHxNXrNXNsc5MVNzhpA:bSDS0tKg9E05TKk6L5gpA
                                                                                                                                                                                            MD5:23961A289D57B15CE78E725C8DB95124
                                                                                                                                                                                            SHA1:AD22B0DF2C88DCF74C75618042809EC228660100
                                                                                                                                                                                            SHA-256:0B428DC30D2F11B851BB4790799644079FD5102F760496BCEE1DDD5447B3233E
                                                                                                                                                                                            SHA-512:D90984851193DA69AEF3FFA6F5F2710D230533205A190619A47F006EE9D6CE92085B0E04C23BED04269057B3620B3CA732679A1EE4F1134B6C60C7498672CC53
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\Icon[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 60 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):533
                                                                                                                                                                                            Entropy (8bit):7.415663553371965
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:6v/7Ya7/6Ts/o7hJW8/t8oX8qUkUGGVIXC/zoZ3VYZwWSVR:E/6pzWK+q/UGGMC/zw3oGVR
                                                                                                                                                                                            MD5:B6162D100379E7F4EF709BA5C26D1BA8
                                                                                                                                                                                            SHA1:AEA4244C56F00AA26064134863157A6EE9D7ABB9
                                                                                                                                                                                            SHA-256:DCA74022BEBB4F12F8EFADD226C9413CAFFF9193420D604DE8A398642172AACA
                                                                                                                                                                                            SHA-512:CC64207C45F85255F34A157C9370A46EBD4A2B3A674E639838EF7582FD93D68F91A275C577E2FC9A46674EC765D8CC43A5BE28B281FCD5006D38D0C6F02E2058
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR...<... .....N.......pHYs.................sRGB.........gAMA......a.....IDATx..=O.1....$....1..7.....p32..)..Yw..p..IL.$qT'......1.#.h..j.5...9...~...w.....oe.....]8,..|..........``.$a.K.&Lq........D,D..8e.c.....fQ...u..%.(..b..8A......,>@6....Y*...9.(...d7........,!zr.N...T}.....j...NY'..|.=N2Q&<?3....@..-.e.h....F#..2.v...n..!-.e..&........%.e........y.c.y,.e........4'40.t"...B.........D.../[D..6j....^>.....g...3...5<Hv.H../M.+Y`.......OXw<a.al..aF.@.../.E....=;S.K....s.......IEND.B`.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\ast[1].js

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):125250
                                                                                                                                                                                            Entropy (8bit):5.366459254148267
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:QY0mqjfSB5TUVJTwzIYo4c/tJX+QiKCWczYxreKan5CPO4a8+DHAizsjqLZ7Ea7l:Ata5T+0K4KaQiNuF24AdsWLZ/7l
                                                                                                                                                                                            MD5:4851F99F7147D56FB954D81055CA2D3D
                                                                                                                                                                                            SHA1:8D7982E0B6329C0460F0EE61CCA0151181326F2B
                                                                                                                                                                                            SHA-256:97711CF6D03D55D6DFA7BA68473B2D0D3C64C963463100F87F6792A4D0D080C1
                                                                                                                                                                                            SHA-512:21F2B58E5FAAF45A80D5E472901A430F3FE49286694991E303939D1280716885F4A31C422411843B02A9CE9F409A8042E0A39320A4CAF0FF1F114870D581F7E8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:/*! AST v0.61.2 Updated: 2024-02-13 */!function(e){var t={};function n(a){if(t[a])return t[a].exports;var r=t[a]={i:a,l:!1,exports:{}};return e[a].call(r.exports,r,r.exports,n),r.l=!0,r.exports}n.m=e,n.c=t,n.d=function(e,t,a){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:a})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var a=Object.create(null);if(n.r(a),Object.defineProperty(a,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)n.d(a,r,function(t){return e[t]}.bind(null,r));return a},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=12)}([function(e){e.exports=JSON.parse('{"o":{"UT_IFRAM

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\logo[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 1633 x 708, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):27928
                                                                                                                                                                                            Entropy (8bit):7.701164569435742
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:xSufGKAfaoovahBv4apFM4lvzDpqFosGd+Up9FIK0B:jfUMve54E//fCiIK0B
                                                                                                                                                                                            MD5:862D29153222B9B15C3C73B61B930335
                                                                                                                                                                                            SHA1:391BEBF4BA8910B718C5516491EB1C7D32D4C187
                                                                                                                                                                                            SHA-256:3EC8FA41DCE2684102F4A7B2D993388809CC2F6AE0616807CA9E3D94E6D19AC2
                                                                                                                                                                                            SHA-512:6FFCB08DE27DFA571C8EF35E7F017F2871482581308C10CF38EFF9A507D02325222B899D667FC86227C2985ACA05F17C1CD33EF4163BE3442F70F8907BD78404
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR...a.................pHYs...#...#.x.?v....tEXtSoftware.Adobe ImageReadyq.e<..l.IDATx....u.7.0.A......@...T`o.f*.SA...T`...+0UA..BU.X....a,.......u..:.%..`... ..........a. ......................N.....o..z..=.....r!..^..Rr.....J..b.{..x...9^....u.^.?+.......!..kQ`.....$YNo\/..km.4.n...........1H.0\e.$]^w..K.^....r{I......0.I.v.@!...6.r\..JI..n..9W......<.$.O.0.3]...W.|..n.B&%c.)......cI...e.K.^4....ZX!......C$a..rl.x....|%..I...x.]........I..m..a.?.vml76.O.:.lW........0|..!.M..D4.%..Yt..1+......h.$........w..c.B......&I..._.e..R.%c......#..b.K...d.....@c$aZ*....&..R4.F2........0-.r..n.|y#..H.Y..VB.....P....n!......MZ..W,.E.........>V..Z.!..E.ND#{..:...\(......!.Sc..0....Dq....eK......(.$LM.i.K->t.d.g......(.3a*.~.......x.b........\V.^..C...A.....Y......@Y..)X.a.?V..L.R.^.~+......e..)T....x....2.=..y..............L./..!..:^..}.........Y.S...i.Xv.0-K.b>.p&......y.......r..~./>u.U1+........0..!.:..x]...Z(......#.....<~.....s..........

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\me[1].json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):84786
                                                                                                                                                                                            Entropy (8bit):5.354403585851262
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:eYPezQ8lOlSaoPeDoRGk3hZgDDqYwlKolQGh2A2CpscMrA6A3t4dhodSl3tGS7Zk:eB0U0UB7y3P3b/S
                                                                                                                                                                                            MD5:DB2EF4E89BE9FFFC7B0C44D61DFB7B27
                                                                                                                                                                                            SHA1:DA3E8022B3B4959129EB7F1ED5F8BFAFB9152500
                                                                                                                                                                                            SHA-256:9141F19A2E2CFD3CC2C386A0F34A524D2B9D203CB49E865479491DCF2771F6CE
                                                                                                                                                                                            SHA-512:E392F92F559F5193391910935D2AF0AE060258C90CA5C6BB31A12C50C90D182E5B151988CE551E2672FCCE32D610D7C3F51F476E132C5560C74FBE8F93849E12
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"nextPageUrl":"https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=438ea948-874e-41e5-8182-af419f789b30&$filter=_t eq 'CompositeCard'&contentType=article,video,slideshow,link,content360&infopaneCount=24&queryType=myfeed&location=47.7159|-122.204&ocid=msndl&apikey=Io4orNtwRr08vQQBER8stWzJbGltMJzMwkmiMOv9z3&activityId=7FF05383-E874-420B-A4A9-263700520B95&responseSchema=cardview&cm=en-us&timeOut=1000&WrapOData=false&DisableTypeSerialization=true","subCards":[{"type":"infopane","subCards":[{"id":"BB1jRDip","type":"article","title":"North Korea's Kim drives new-type tank during drills and calls for efforts to prepare for war","abstract":"SEOUL, South Korea (AP) . North Korean leader Kim Jong Un joined his troops in training to operate newly developed battle tanks as he called for bigger efforts to prepare for war, state media reported Thursday. The North.s tank training was seen as a response to the annual 11-day South Korean-U.S. military drills that are to end later Thursd

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\thZFXCZ3SB.jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):12138
                                                                                                                                                                                            Entropy (8bit):7.95331477489898
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:S6f3egeHEdvx4d7z+b8mg7l9yyyKc2Bfqh83eKHk1xqRDQjRZ8E6RpDP:SUjxG3fl9yyPNBfqRxqRDQjRZ8F7
                                                                                                                                                                                            MD5:69ACD79BD8C751DBC34BDF87F9B8DB7B
                                                                                                                                                                                            SHA1:B4655695F504A83F3945252AFCC07BA89E0783CE
                                                                                                                                                                                            SHA-256:AD697728E724684946E90AA781F8CCB6F2BAE2902FB9C98E7C4949AEDBFAC2A0
                                                                                                                                                                                            SHA-512:8E90E1F8A5ED0DD1007012B5502AF0DC1A165C37E59397A8B707826C1F0A410C0F821A7F61FE8E0E859E9A7AB6B3F598E8F972D562A12DB1ED20FE15566A4301
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..$..NP=).Zp..W..`zR--......J.J(.....J.Zu.".r.h..|;b..6...X....vd.....+.....=.[...+..3..$.P..O.w$oG.Ez..0[[..<nR.T.......=.....X.i..y+.|..S.Q.:...}x'.Y.^.g..l-@...c...#...X`.3.<W;.;.IX.y.j...m...o.3(HnG..9.l-...$a.U...c.....6..>c..).n.3..3T...{.l..X"2.68.A\1..#.....\E.G...q}t0V).D.6.lRP....$.3...Kse..j...0..Q[2..S._.....#.H<.k'.Z...}..y7./.(\...@8...wV.......C^I

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\th[10].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):12781
                                                                                                                                                                                            Entropy (8bit):7.957790965756766
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SV91LDrEgr5Sw44EVpkVBbA3UOUs3b9BlYuZUMTon:SdD95ZEVyVBbAEOldZUMsn
                                                                                                                                                                                            MD5:7E4BFED93BCEA501304993F6E31289D8
                                                                                                                                                                                            SHA1:5E170E589683204C943DCE8FABA3E71C67292FC0
                                                                                                                                                                                            SHA-256:412CAB8835041A966959CE4FC068C8704C2CB69B4FE8E0306B6AD640354D0A7B
                                                                                                                                                                                            SHA-512:613005B8D202D4ACC8B2974308956A6AA99DD7360FFA6716F2D305557B7FD3E1BC765A25DCAF8E404098BEA8185C906631DEFED1071E9B680B80771C4C35F62C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....kk3(...=..B...9...c../...\Iq:....k...O..e.u..2.....1..%'.e..b....o3.Y^ .".Bm$...=JK.K5....7>..O.#At..6\}...$.:*Wt..D...I#..e...OZn.df..MH.6...V>rRrwd8'8.^..mO_....>%..n...j....3.v..l..P......nY8....>\z.~4.++...;..L.S....._z...T..;.......#C..#..X.=..k...dO..q.]...X1.......C^..Bx..;...bm..8..cA[.....5)T.....O...k..K.x.m...bl..^....|..qZ~(..U./.$2I+.w.aYd...iM

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\th[1].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):13234
                                                                                                                                                                                            Entropy (8bit):7.959835494634161
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:S7sbZpqTpaeJz5seAz3jISgSg2KNKQ+ZUJ:S7sPelz5sRz3hgS8NK/C
                                                                                                                                                                                            MD5:C03A1164670FF26B42BE0A9BD4FFB581
                                                                                                                                                                                            SHA1:75FBD8049D28073341721EB1B061AACDE2B58DBA
                                                                                                                                                                                            SHA-256:3BB00F6D344C5E199A64025EB1EE4586A111A1B170D6B4CF53FDFBCFEB3A49A6
                                                                                                                                                                                            SHA-512:DBBE2E5929394DC0D7BEA1A05C95BD6D203A3517009C5616C9E09C1D1D3F78050DFAC66B22FB01D37718A019FD0AD66313740E55775EF43E3FAE23E167734EB0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..-.16..}.x..z.^....n..vn-.8..H.H..Lw|.>f<.t.41.(.!U.(8y....y..~.>.qL.....SBc...a.Oa.......37FL...]........FLd,i..1..;W+.[.u...0.3.Db.....'.S.BS.9...?)n..T...a.W1....*B..F{.....rb...=.N.h.2...@..,q...k...jI......I...CI&..~3.Z..4.../.../.5.].s.).s.t.X/.m*@.t'(.cp......C...r.k...3P..._3.e(....?.gx.....8...Wm4x.M....9...-.......k&.+..-....I..M....".$P.....T.r...

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\th[2].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):13370
                                                                                                                                                                                            Entropy (8bit):7.95421187293376
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:SElYx6xx1XvurUYOGIJioB7KnC2UiF7GkTM0I2FaZQ+sx4U8fgSuk+uiVX/HK0a+:Sm6mGrU2IJ3af9vA324Z9MXVy1gv+m
                                                                                                                                                                                            MD5:CCA2FC2DCF0AB1A03D50B784ABAD16FA
                                                                                                                                                                                            SHA1:7462730A352C0A65136347B5BDFD345FE08FF177
                                                                                                                                                                                            SHA-256:3EA64F4A046454494C83F3EE976D140E15A6F2E3BD308B2D3919F73A17876D79
                                                                                                                                                                                            SHA-512:EEA9780DD45C9AA253F981ABF4774396CBA36D46025CC5AC693E7797078F6DF6F626C1E204ED663DEDF4882855A4FD95943954541E9A7FEED08E09E20BF3FD02
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..[_."...7c._.W...U..L.9.b..w...\.2.2.J....1,k4.?..;.yO ....}>.V8.(..W@~....-z.....|..TV~"....).h...?.U.."...[...............E3....g.7....=+.^.G.......i.u;[^].q.N..o.....S.>6...Q.......j....._.^..#.I..<M..{.3."....c'....K.z...(...)>......8.......X[.<..W.+..-a0m.^W..}.K.G.q...(cjBw...K.kQ[[H\.l......~....5.<..NzWi.g.:f.....H.W...=.......P.w.z.\....?.....6....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\th[3].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):18609
                                                                                                                                                                                            Entropy (8bit):7.961339198872282
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SfinBw4LJqvPQBipvJbHfcCglZ0Ij00x9TgV1JyHjcox3NBY4FaT:SfinBUnQBGvJbmlZLj00nTQqDLgOk
                                                                                                                                                                                            MD5:41BDFB83DA7E3ADCC4E379986CD10B20
                                                                                                                                                                                            SHA1:169C048B5B0BF8CA896055294E75F8C73DC04378
                                                                                                                                                                                            SHA-256:AA088E51D64355F22DAB4D09BB46E91646A3519E6C481A7FC5AE9DACC4B8DEF7
                                                                                                                                                                                            SHA-512:B95AD9DC9BF6E49EDE9B6722AB11EB6C4C0C44316D753C240FF650708C9FF34F25C602991605F07C95539F1B781C5492ADD8C717C4A5652E658CF266C4480DD1
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....MS\..Gm..Ri:.Y..l..Aj....-5....G...d...;...`....>w.z....[.....Rl...1.W7...`..O.G.&.....i..Ag..o&?.F..h.&J.F...M.@.$...Lb...g.R[.*.'n..^%.....".2f....._z...x.zsY.......ixwJ.P......S....A.}...M.pB..'..Q....;....G..MGP......f0..d8@.08&.-cI.....u.....Z-./.......S.@8=Xs..x^O.^4.&....6.....Q....H2...`...5...Ytp..+%.WT..0...j.m../......+".N{|..@..a.Z.h.5....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\th[4].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):29908
                                                                                                                                                                                            Entropy (8bit):7.940507266165066
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:S185aJT9eoHOC0rTPa4ZM12LrgFeCorBSTfF:Ssa59LP0BK1AyZoe
                                                                                                                                                                                            MD5:4786358A8D2583643CB11C72450B0511
                                                                                                                                                                                            SHA1:29C7EED9217379FDCB22786A29C62C08537F0945
                                                                                                                                                                                            SHA-256:A342C32EB9F566BACE1E74AFD750828FF663C3940F3B430D4B47B60C79B4FB93
                                                                                                                                                                                            SHA-512:40264466171D2524FFF1A4E0A51595039E10D7181526BBA38B9721EB657A5B838E6233CDA8E29F707889A7FBC6CD77E5F485A72F71F55175E14196CA9A650E09
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....:....\x..v.7......0..Z$..S;.....=:sRx7........V.4-m<..+....WV...H^L6...P.e.x.1.P.1....JY>%.E...K...Z..(...>c..t.......'.:.5....v....-......)"..JF...d.U.}.*<.).KO.5..5.xJ.!........-t.V.u*@O7.G$...W.#..A..t.M...qD..#.!.1K.>.0....s..6......#.....q.U..J.I..uU...H~M..J..$.6.<.;f..E.h&...F..a/m._....u.-.e....5..*.u]G_.T.M..M.....v..0H...V............p5.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\th[6].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 620x304, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):47155
                                                                                                                                                                                            Entropy (8bit):7.962408510250815
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:RDywO2FyaDTLovqrjGRm7sLlTQCH86mOiYefvv7Su0XbiIpWiM2ekvTRdKJXwTyU:RGwO2ofvqORm7s9QCHnmcDpriMTRfy7Q
                                                                                                                                                                                            MD5:E31116711B1B8CC53DAEB9CFA1478FEC
                                                                                                                                                                                            SHA1:ABC1B9843F7C0B298DC667FF6F52F0B8BC898D64
                                                                                                                                                                                            SHA-256:69701886F154F38F358D93CF31C1644AC3145C11ACEA32AD2323995046C14289
                                                                                                                                                                                            SHA-512:05367B76DA475754C5A20D5F8F5EC663C5A130B04382C26CEFD230D0E434CC7416C3E9F191C105B93465423BAAD1456E0967C394E01604F981D37893F99C8EE0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.......................................................................0.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..>.II-..=.Y.[=.z..r"._...r.T..:..C...dV....^....+_..|.%....J.(.y..+2..d>Z....+..G.Oiv}..\G..W..?....h.;W_om.+.. .).2..YV...J........|..|.q3I.....k..|5....m.F[...#...}+8.......l~..,d..=.-4...Iu...Y...ST.O.>....b\.....C..".......>.)..T{.......z...V9U.N>CR.k)...f...!`.em..F*k...8....51.o...[....H[.j........]..Cy.h8~....F;.[S.F$K..9....9..L4.3c...(y.J.-.+O...o3*..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\th[7].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):19275
                                                                                                                                                                                            Entropy (8bit):7.964569281213879
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SF/tH8Y15tFyCJU9Jncn9vTY+QQoZbmHFOYeGKcqZYzT:SFVH8S73knc9c+doZbuF/qq
                                                                                                                                                                                            MD5:1A2BB5A8E741EA94F4F9BFBB79188962
                                                                                                                                                                                            SHA1:30007167226737FADF2A1BDFCDFB43ABD85A894C
                                                                                                                                                                                            SHA-256:6A50CAE58F69DC963FFAF54CE36A106CC4EF863A36F66328B91037234FE5BE78
                                                                                                                                                                                            SHA-512:2BF4FC2C475F51883799DF361CBA765FE81DF8C5C8C112B70308CEDEF985E8C61F9D8FEF4980FE602AF6ED9C09E5D2EDBBA0A92B2F61AB493FB6CFA8EAFED9CF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....C%.j.S].....J.;y..y.dX.hK.7.k...k.IN....b0.i..Y....Y..b...!.._Z..Ui%....V.+.9o..qb.3.Q....4.I<..)..w.M...Fh.....+....\.....i.o...d........ ....6....h.+..4).+<.,FF;Rb;m:o.......f...m..`..u...I>....E.c..n..:.X...G....tA<7.3.U-.x.r..l...fd...4.../J(...-6.@.X[Oyy...o..A.K...W.V....o......=^.G.......&..p);D...>...I9...f....%.D.+j....#.?.....i./\.V.y{{.$zf

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\th[8].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):15837
                                                                                                                                                                                            Entropy (8bit):7.961425704044774
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SXE9KYNteblIYos0tGJf1D9Il8LY+TQ4a5J6WZXFAb:SXvYNteBo4ql8LY+s/LfZXU
                                                                                                                                                                                            MD5:3DE2AB15BC51707C6912CBE8025BFDF2
                                                                                                                                                                                            SHA1:D58D11F1A34944A7AB9DBE733A08A1DCCE090C9A
                                                                                                                                                                                            SHA-256:229DD212C291FE95181213039D65D650F41E916DA34F38DEE961C68A76DFB9D0
                                                                                                                                                                                            SHA-512:BAB5DD2608022953503A7E4CE2182DF254D2B3A45C2444E40100C0E5DBBF628108D80D51290DD35C65CD2DC4DB0FBA795FD05C3A837EEA30F908E81CA60D2D99
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..if&LU.n%EP.O.:..ns....*.X..Z.a 4#.9.).@;.E|-E.q.Z...8....ij.O.5...T<)...rz......b`.....jS.^Vn.......G......|.*..6.`.W....&..n..e[}>..\?...Q..{"..V...3.....Iu.,ou.....].rG.. ...+..n..|iy.b.m?Ii4..W.6L...}K8......_N|6...^...^n.>}..0...@.>..ay..+D...}+M{..c.$....a_.x.Y.~3|XM#Mq......1....v...............\/.t[.#y.}.h.h"R../._2.....w.?x./.....Y.o.^.X..]bQ..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\40UWWPGL\th[9].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8944
                                                                                                                                                                                            Entropy (8bit):7.937306498535976
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:S66xKn8A82PdmSNJeqbA6mhNO9qPlmG2D7xERnO4y8Eh:SgLVv30NnGayn
                                                                                                                                                                                            MD5:1A1A063FB2416ABB4B06C589946A292B
                                                                                                                                                                                            SHA1:64EE1AF35C7CFF45B3D480F22BC83003E38991BD
                                                                                                                                                                                            SHA-256:36DD8ACA0C2E8B7AF4CDEE5FFA88DB4F83410EAB5418EB2AF025FE8842ED63F3
                                                                                                                                                                                            SHA-512:94ADE978D85B5CD165D03159EE42E38D8E2C681ABCB407BAA213709BEF67FFD20354EE88A0952895D964A4E19CBA483677C6F2D64681697D4743D5B8CCD2D7C3
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..:<*..?*z.0.....v4+.0.._Gc.}GME...s....61^.........z....$Y^+.IW.=+..h.(...N.9...J.T..8.c.5...y.>3...[../ ..C....W.y.Cq......pr9../. ..@{.'..>."..x2z...8r.$qg..06..t..1..). ......N......c....:.,M...*...}.dT...>..S.bs].61.Vw.b...8#.q^t.....djv...*=..Zl.z..._Jn..[..t...K..1..gx.X.4.}.[..@.&....I..Z..m.......r..t.?{..rZe..C...v.....#..kl=.?z[....._..R-.|.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\C1V83SAM\AA10QAZe[1].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 275x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                            Entropy (8bit):6.711996485767956
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:FI9kc/1UGNCyluNqq0SPrZ7u56uRf9cgQ5j:FGdUZyluNq3aZ71Gf9cgQZ
                                                                                                                                                                                            MD5:01FA4C58E0E73B9C80F6D7F5D82E0415
                                                                                                                                                                                            SHA1:53493A2E6349B9D033AA529BE13292929AA4A083
                                                                                                                                                                                            SHA-256:438FD5C271BE5FA32889D99A7F97280D764CA34A83E509C8BEECCCCD31BB76A6
                                                                                                                                                                                            SHA-512:E2418BA0F9B7C1434E7E75013D305F8D5B99B9FE57BCD31B1CF084D32AA79813DB04EBCEE24DC70598A5AB093512A8E0A4E1B032BC36A556FE46B025EA66BD68
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`............................................................................................................................................................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....z......;.4....-..a....i...b...P.q..ZV..R@&.C..-H...a..."(,...@.I.@./.^..<3.6..|&c..........+{.r...n......x.......+...]....Hm.H...:q.'.z.E.&...!..y.}WW........Yev....T...5..c}5..Mm...!......f..z...?h........<.@.-...?A'#.5?.^...O.#..,<Ky....H.[.!V..~........J.....>..E....+...A...&h.M..}...Z.2h.(...!...u.....!'...b.2..j.(.(..w.=h(;.1.4.(..h....K`..KP... ._.X.i0.8.............

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\C1V83SAM\AAVs9cU[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1214
                                                                                                                                                                                            Entropy (8bit):7.599946746969644
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:C/6yU0JRXs1C1zE9hrbmbvTiT9je3iMUEFCONRXTQUBwFaG7:C/6yU0XXu9xRje3FCOfDQCwFak
                                                                                                                                                                                            MD5:840EDBF110A8FF1F0D9CA580AC5EEAC3
                                                                                                                                                                                            SHA1:322B7EC2E8848CE0701323C95EBE68CBC911987F
                                                                                                                                                                                            SHA-256:278AF8DB05B358D4A77C18906379F458402D3E0B4A905A51A5C8A05CA5A7FA6F
                                                                                                                                                                                            SHA-512:A2E378275DFFAED9996262AB82F13EA701A9CA75E50EFEEF1DC09398D5E0B78C64ED12AE0BA7BB579E71AF70ED1D46F54E86F3B93189DC520A8B221539043DFD
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR...`...`......w8....pHYs.................sRGB.........gAMA......a....SIDATx...n.9....H.:.p.N..2@.n4O0.Y...f.b.l.-...H..n!... .t.....7-../.oy6.|9e..cG.....!DE.DF.DF.DF.DF.DF.DF.DF.DF.DF.DF.DF.D...D.v....T0......q...ML.{r...@n0.c.P.}.../R...{^.S....?.aR._pt.1....5....ko\..G.F..y..Nw.W."e.!.Z....a57..,.&.}..{.....X.. eZ!.<....H.V..>.......N;2`g...w.:....o?6.ja.z..R.^.[|...F\u/C-.#u...?|....w.O.B...._.y....`.^.y.X.o...B.......[.10/.6..S......A-.~=..<%.^.....n._..H..]*.q.P.`...B- T..._.........:X..`.C..d...|.&...[..k+E'>......SQ.;m...0...p.0....4aF....f$5......P3.P=..P....j@..X......[..7ze.0A) .z.....uH....j@....s.....<.n..3..0.u..6...&.;..q.05.....N..{.....P.l....LA........@..`./.B...........q...d%.....>xo#.=.......7.=..........8...\..\.|..k.-..*...f..l......`...Sp.uy...`.G..}`.7.......J........1.:4..O.]0.9P.........#.C.C!.....{....;.+....#...a.M..e.."F......7..&.;.1C... ..M.Q(.........! p.......p.g.......9.I?..N.s@...]..I^..}.....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\C1V83SAM\BBI4MeJ[1].json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):5289
                                                                                                                                                                                            Entropy (8bit):5.301084432781366
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:YYP1roA+cBKXFFciVKIqHuqKXFjRklVKIqHuqZcDInY41FsIVKIqHuqo4zHVxIqS:rocBCevC6WZcDgSIs9HACqc8Z7DgDid
                                                                                                                                                                                            MD5:E084C31907683F9AFFD72E819DEAD1D6
                                                                                                                                                                                            SHA1:59CD1C5A5A88CD539E36F54E89C9D10A489A9012
                                                                                                                                                                                            SHA-256:0D46B65C7260B11787DE949D6E12B66A19522F10E2176F2A7D983B9FBE473E13
                                                                                                                                                                                            SHA-512:8691A7515B7F011E6C598E383DA9B25FBFF00A1D6F1F280FA15A150C6E29742106CDDEE43AE0FD5E733F35CC633A77AF39333E05C734E969FEC749E7F33AE28E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"$type":"list","title":"","_isPublishingLocked":false,"_id":"BBI4MeJ","_name":"MGXStoreWebPromo (old Backfill list - DO NOT DELETE)","_sourceMetering":{"isMetered":false},"_lastEditedDateTime":"2024-03-12T19:52:34Z","_links":{"self":[{"href":"cms/api/amp/list/BBI4MeJ"}],"parent":[{"href":"cms/api/amp/section/BBREXz4"}],"children":[],"feed":[],"provider":[],"references":[{"href":"cms/api/amp/image/AA1i0jET"},{"href":"cms/api/amp/image/AA1elCIp"},{"href":"cms/api/amp/image/AA10QAZe"},{"href":"cms/api/amp/image/AA1md5qf"},{"href":"cms/api/amp/image/AA19yQae"},{"href":"cms/api/amp/image/AA12PRKq"}],"section":[]},"tagEvaluationGroups":{"_tagsHash":"3145739","tags":[],"vectors":[]},"_locale":"en-us","sourceId":"BBlbsHE","keywords":[],"facets":[],"labels":{"category":[]},"list":[{"link":{"href":"https://www.lendingtree.com/?splitterid=home-equity&cproduct=homeequity&cchannel=content&csource=tradingdesk&esourceid=6475206&mtaid=2D09E&rcode=10000&s2=borrow25k164_flagsidewalk&ctype=sponsored30&c

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\C1V83SAM\desktop-shape[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 7 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):197
                                                                                                                                                                                            Entropy (8bit):5.986656121330302
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:yionv//thPlyyta2/uDlhlp8Lts7CX9/2yx24lSXqU3hjg/BFCb0cCHxlbVdMaW9:6v/lhP1b/6TsR/R0Zjgz89CXVdMndp
                                                                                                                                                                                            MD5:34760615AB0C180EB4B48739297FD0F2
                                                                                                                                                                                            SHA1:789438D09CC27A08879B1A9686C82527270E7C24
                                                                                                                                                                                            SHA-256:360C33D59E7358579601909D4CE91F1BCABF9E07BEB8F69D50C226D7D8F91260
                                                                                                                                                                                            SHA-512:1CE7E574D45D123C6B52119907E74D71B842F1CC380D79AEF876FDBC9FDB663F385BB4191650813D2E66EFE24265FD36EC944AF95F372C0413EDCF11361CA666
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR.............e.t.....pHYs.................sRGB.........gAMA......a....ZIDATx......@.EA.`...U..1\.......X]...G..{..HU.4Uj.`..O .3;..\..!3...q....[s./.@@..p...>.`(k..2.....IEND.B`.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\C1V83SAM\mobile-image[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 375 x 180, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):23972
                                                                                                                                                                                            Entropy (8bit):7.983082688064765
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:OQCmhN3Hqqm87sSOvS8PJKCqedNV7TMzNjdpNQsjtHnUSQkBmSfYuoq9Dgt:dCmr3KqmIdO68MAnnWNjdpBSSQVfWDgt
                                                                                                                                                                                            MD5:64C4757048F068394817EE126FDBA8A6
                                                                                                                                                                                            SHA1:3610DC2EB5E3C09809E94BD0694A06C7A51580FF
                                                                                                                                                                                            SHA-256:A9FEC8F56726ECA81D0600220A6B168FFF112A5283741FD5EC63509AEDBB51D5
                                                                                                                                                                                            SHA-512:373EE45E16D231B2FF8A897A357A52A58B63430E0BCF728867879F2E10E55C631589D6F63C1675E2E40EB1EF7CEB59B15DF18013EA0F3FA352A3B36296F14DAB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR...w.........o.lP....pHYs.................sRGB.........gAMA......a...]9IDATx..g.$Wv&....H_......n......1...g..r.IQg.]..?:gWG.;....s.#........;.!....a`f..n.h...].dV...{.......j.C........|..}......................G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 .8lh...5.Hn.R......j'R.;|j!..I\7...Z..G...BhB.<}.....G..X..-...w"..]f.v~..+.HI...#._.k.S.k!t...n..;...6..`...G...L...../...1...Hz..:.....j........a.."..M...(..u.L..+m.3.">....i..pq..v.!..p...m7.gH\.v.{.....j,@...w:@.......v.....>).w.......G.r..LKmE.@........K...v0^........v..b...ja....@t`..u.......{D...}./}...}g.NN. 6..]...PS2.q.Ge<..v ..D....B..B.V...D!.T...@>G.....u.m4.Z.XZ.\X...j..F.Y@.... .."z....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\C1V83SAM\th[1].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16738
                                                                                                                                                                                            Entropy (8bit):7.960232536778191
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SpIBTaXr3M3VtKLl55dFkX7dX4ZzYU73eNyI14oOwG8Fbxm3NWVo8BL2a:Sae0sLj5dmX7CYU7eYBoOKxINWVo8Bya
                                                                                                                                                                                            MD5:B04279A7ABEA7B23C7753436E94E5A4B
                                                                                                                                                                                            SHA1:4AE700668908BFA2FB7D48B56B406220FFDB5145
                                                                                                                                                                                            SHA-256:AD16D11399E7013CA81682D899FB63E0436E134A61797E5245AA40A8C7D91506
                                                                                                                                                                                            SHA-512:294A954D9739C14CAB3C60B936F7B73A143A061FD255D6170555B48BEFFAB6F77E117B2E894513B87224A39B289AF91FC7452A671AC664AC6CF4831EEC89E279
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...N.l4....+kh.8.0..`z.~r:Q..A..Rg.IG...y.4.)qE...H.U)"+)..d~.&(.(........;D..G-.~[~k.Y._..<.~.....r\~N..*?..T`.E).u<....=...zy..1...!..........jIp..[.?.$\~..|..V.V.M...S..P.....{......&.Y.D..s.......C........YWd..}..?Z~..a...9[?.z,.VHn.r.....T.?...^.w8....0;wes.....?AU|].x/K..5..[iz}..-5...aHPrY.c..'.9.HXx..C..t[.7G...]B[.>.y..pX...%....Rr....2...>~...u=Z..x

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\C1V83SAM\th[2].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 620x304, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):62211
                                                                                                                                                                                            Entropy (8bit):7.970993595539617
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:R+VwYeF4yTR9S1raoxJNSn7hLJ2aYPfneg3I/2:vYeG6wraoxyn9JSeCe2
                                                                                                                                                                                            MD5:9EB7D6D111DCFC2276D1BAA3D8A7522A
                                                                                                                                                                                            SHA1:E563E82300D5437AAE7752B6F4059EB58E89CBE2
                                                                                                                                                                                            SHA-256:568E6523CB62A8AF03A8F36740221B4345EEB078B9296B57B29A2872B3C4D3D5
                                                                                                                                                                                            SHA-512:5EBA6C59A59233C3C5D1D22E205285E51BB017C1CC60F72E85C06EA63A5FCE7FADB951ADC606190325665400F4EC2B1FF73D09632C81AE192F16794569A91B9A
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.......................................................................0.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......6...r.........bHbz.I.......t.+K....4.&.^......!_...t!.=Er...l.7q..R.di......,;@h.9.....^.Z^x...^..mH............l;2.......s.|.N.+TI.x...NMkT._..x|".nL.Y..fU?h.q.c|..{.o.Y]'.vZ.....,L..>9..S.......k9'[-.Hb...........!..*x.Y..A.k....f....X.~.......`+.'.:...j.Q.+...H...HG\....j...J........+.....)..F..Z."....[L....'.a.zf...u.+=..ec.Nj..i1...yz...1v.c.._lm..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\C1V83SAM\th[3].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):12348
                                                                                                                                                                                            Entropy (8bit):7.9531684691073306
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SQwaE0pWbHx1IwAbZ1ihJS7x95jP6vR179u9c65:SEBAHx1HA1SG9U9X65
                                                                                                                                                                                            MD5:E79F0949A8EB715895A012E3D6B21162
                                                                                                                                                                                            SHA1:F927F8BE269D55DD8C3C60AEB06DA47682865D8D
                                                                                                                                                                                            SHA-256:A36731AC657C5CF8403ECEADA18BA1FE5295C38DAE1094C88D9C2E1572F18F70
                                                                                                                                                                                            SHA-512:24BCF9E02A032E971A55518CB70742C07E94572E66A5A99ECB5BD29901D2AF98FEB9D7B088854C8D7DB716B71FE5834F1A828B43962F09E777817171E6AA4162
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......e.a.8..5..Y....R\..t..@s.Ag$.^c c..5.H.-.6z....e..({.......9`pkOy..k.XLe...>.Z..6..1e...=...fs.J...Y..O..h.5....l..RFn2}...<..rFj..]E..,.S..!......t.42.>U.3.u>.JH.T.......k..y,..crg..Mn..H..V.....B.).......c.U.t.b....T.Y.Fm...3.Qtd...S...x.i.ZB id.....v.`{.d....*.i.2.2!8...v3Y>jLsK..=P...a.O*..:.5...]N.q.M"yYSi.....|..;z.p..g.,j.h..?..4..y4..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\C1V83SAM\th[4].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):13338
                                                                                                                                                                                            Entropy (8bit):7.955914241534138
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:Sg2J9B3p1qbxR/ahUpKYAWsiz5qgIZq8ZcosHVp2bobexDOEnLrUfJGWzBmyoaRs:SVj3p1qbPCJ1agq8Fi9buDOEnkkcUyQZ
                                                                                                                                                                                            MD5:8ABFE7BABC7F973CC7D5558FAD021247
                                                                                                                                                                                            SHA1:E16A46AF8DF891B4541716B552B305C1FCF0D737
                                                                                                                                                                                            SHA-256:A60D9070C0BD4107A6ABD798479E50AC3F465426035BAB90E246D6208391923E
                                                                                                                                                                                            SHA-512:F1E8850CE6B2B924B66D51DB9C1C3552070AAEE73F3014C7BCB0E21C457B10FE2FA16FA6AFC0FD40A012A23C21B7326FCE42BF0648765678043649840D41F339
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...P.2.Y..W.....N*..Fq^.g...7.I.~Z........d9..........V...W...[.Xu...9.3Y.w.]?...F.z.p.G\,...4.R6Ku.7-R.......V.5WN..o.\Z..Jp..4.4.S.;.q...A<.b;..y:j........<Yx......k.~..........W...]...6...#....`..==k...8..y....'<(......./.u......+..5}KU.L.4@|......u?Z....h.f........Q.h.t.&.2..2...5....)..s.V...W.T..$En~c!..=j...-*+..Z.n..*.zz..Fq..r....%..dn.=*.h.i*..c.;M

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\C1V83SAM\th[5].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):14595
                                                                                                                                                                                            Entropy (8bit):7.954087850733063
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:S8r7g5IyS39e4Hy+cyLEUnMjv2mpJ6VnH9df+RZ0nZZZ2X:S8UIFt5cxLbBmVHjHw
                                                                                                                                                                                            MD5:BE8EE2CF5C241E2E6122FD3B6949F190
                                                                                                                                                                                            SHA1:C4D6E7658F9ED3D500675131E02314C134FE2C29
                                                                                                                                                                                            SHA-256:1B1AA1FF32A077647DCC649FBA3D5DE49A957B642557D1135FCC161626F3EE02
                                                                                                                                                                                            SHA-512:445F7F16408303A4CE3087D88480400DEF6E2CDC5F47520E067A6121E252182F61B271B31EAAA34F9B391A7CB4C41F4B7E069235827D264D55734110C119FFB1
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.._,....s.>..C.....~s.C......S...EN.m^......B..*_...yo.J..g.r.b....2.lb....2F....3\..l..hC3D88..E..V:.Upw:.._Aq...a.U..YN....Zk..........T.b.b9.{.....8.w..f..,..p...6T...x.w...0.l...1.w.....WR.d-..........v...qY...~Q\tqR..uU...\M .Iq"..k.6.~.......FQ.<..Qey...EVgbs..2.........v8.r.\..R.Q....L.4..y..T.N...zR.v..loJv.q.....K....-.JU.N..i57.....S.M;i

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\0ERUMRJZ.htm

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:HTML document, ASCII text, with very long lines (58200), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):191148
                                                                                                                                                                                            Entropy (8bit):5.462474272511518
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:nIGhqUwMa1ar2FtZmVL3GDoTt8GxHLiE25AglWG4g6U5NgW8uaw3duORA/FpNnDW:IG0zNFD4LWDoRLk/h5NyhwNuORAK/xYU
                                                                                                                                                                                            MD5:3D74CD743AEB178A726FF35BD9EFAE08
                                                                                                                                                                                            SHA1:EB10193FA4677D98CA3C6A88E11510545365030B
                                                                                                                                                                                            SHA-256:DFAA7053539E032B90F191F868847FC9A17E54BA5B9C22D28BBA27611984FF6F
                                                                                                                                                                                            SHA-512:608D4707B678C557E7B9C9395A57E04CD141C769AD3BD6B953620DA647AD939866E52F3FC4DE39BABA6EF430E1306D6420D2DDEDBFECFC819D98264E95A14C4D
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-tat-msnvserp-t,1s-msntovserp,mms-sc-sc_con1,prg-c-visser,shp-xap-gr-ps,prg-sh-carrsb,prg-sh-enitlea,prg-sh-enitleactt,prg-sh-genreco,prg-sh-genrecocreative,prg-sh-genrecosubkeytest,shp-xap-gr-noux,prg-1sw-sa-qryannt2,prg-1sw-sa-ltmig0311t,prg-1sw-saql2restrictedt1,prg-1sw-sa-l2prerelvft4a,prg-1sw-p1size-inf-wm3,prg-1sw-infiriv,prg-1sw-p1size-inf,prg-1sw-p1sizeinc,prg-1sw-pagefilter,prg-1sw-rivactsec,cg-rr-ctr,1s-eaop1,prg-sh-badgewc,prg-fin-chl,btrecenus,iframeflex,prg-adspeek,1s-winauthservice,1s-ntf-hisenc,prg-1sw-samhibrnc0,prg-cg-uxprod,btie-fancy-img-t,prg-ad-ai-imgf,1s-fcrypt,1s-shp-xp-ectocnrich,prg-sh-ectocnrich,prg-premier-pr1-t1,1s-xapentprong1,prg-1sw-pro2pre,1s-p1-bnw6,prg-1sw-sa-bnw6,1s-ntf1-fyrvt2,1s-wpo-pr1-ifpsc-efy,prg-1sw-brnsspotbd,prg-1sw-fynp,prg-1sw-sa-fyrvt2,prg-1sw-ccl2-gbg2,prg-wpo-pnpc,1s-wpo-prg1-cnsimplify,1s-ntf2-fyrvt3,prg-1sw-sa-fyrvt1,prg-pr2-fy2tit,prg-

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\AA13slaS[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):678
                                                                                                                                                                                            Entropy (8bit):7.549466969667681
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:6v/78/uAQzm45uU7BTzRHZogsxGQZ+asN9cQyPrTEJqa9zK4gMRUYsrpbwMj44HM:wAQSlUVT3oTxbSxIEozb4kpsf61A/
                                                                                                                                                                                            MD5:B9A6161B4DA6AABCABE306AE2AED7DE2
                                                                                                                                                                                            SHA1:01FAD80083112BB98F8F051AFF01EFBA9C5C71DD
                                                                                                                                                                                            SHA-256:D0A862E121F1F61B8E6A4FFCDFBFFDC63299D6DC91F15B68BBF00B62C7D6F118
                                                                                                                                                                                            SHA-512:8566DAD71DEB6906BC5B431B94BC8B9AAF7CB4A14FC173E7D13B0D8A910ED1B8962ACEFAAE41AAA732341D9F3DCEA4525DBD5C7571AE4007875B4BCBCF7E4110
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d...;IDAT8O...O.Q...SZ[.u...].E[KGo.fn.jK{/[.P/...Jz1RY...D6.=.../a....#....7.......>....~.}.9....'....&....g_A....G...6A:.O<EY.~...H..y.:.E.y.a....<9A:...J<.....#a3....e.Z.it.[h.%'P.r(....|.\2..D....#..=.!..l..UW9.f.c.`m}.e.i.qRW..k>8#68.l....../Af/.W.@...*g3..g.$.L..P.N.7..F*!v..>~..x.2...wa.......hg..{..w...n.1.......l.,..`d~...v...g..5.Q.W..*....?.'.)..wJ.........!..A..^LE.....}s.,.1.e..$~B.#.B.S@.>............E5..2......h..R..\8o<..].~*..+.c...-w.,....9A2..e..*w....j.....0e......i.%'`.2.Q=.D...P...c...@..=5..r...{..<..Y.1...x.mF..V....((.w.?9"....0.....IEND.B`.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\AA15Yat4[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2013
                                                                                                                                                                                            Entropy (8bit):7.81099098044133
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:qcPmqB8c1a5ShKNuK/z3amAq5zGQy7EFUQ9:J178ohKNuK/zLwQ9WQ9
                                                                                                                                                                                            MD5:1F3C2A6537F6260FE81A7CBFF4BC431C
                                                                                                                                                                                            SHA1:E779F157168D274F1FAB870C85349C9A9F9466CA
                                                                                                                                                                                            SHA-256:31D6A3E91B525A985991C7B179331B814C77B54193D22E594B09018FD7AA5637
                                                                                                                                                                                            SHA-512:A3004D5701D6E88D35B5F946A26D0C893D681E9F8651C7E0F0996CA85048685C37197BE975C8E9AF3825F77A5582ECEB246687851EA221837770A8DF257DE599
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR...`...`......w8....sRGB.........gAMA......a.....pHYs...#...#.x.?v...rIDATx^..K._.........n...h..._.T...c...>h.J.OD....c.]....[..4."".B....`..^..~'.>3{.......,.k..3...g....,....CX..c.0...0V..X..c.0...0V..X..c.0...0V..X..c.0...0V..d..vy..)....-j.\..V.^M^x.].._.|!/<...0u.T.={6,Z..f...D.>..........l.......b..i.QM..l..9z.....E.-.Y....Q...,//....^.-.F..............h.@..g....V...SO..+.<.>}.s...'.L....]....3.ah...l.....=.:w....q..}...'/..}.6TUU..OiK0Z..........fNQ.0..oa.....+....D..f..eT...L..T...t~..AG...3 j...0.....r.G..A[[.y>......X:..Xgg'..'.3............m.pww..*.c....E-.eee...3..Y.l.444../.}sg!..;w..'...#G.@ss3y.\.4...6..X...3.0u.b``.9v.;.e}....z..E.....aH...O.<q..'....l....r..i...K.....\,.p....I[....Z...(...w/v..u.`.}.!f...,..E,.....L\.....PK.._S+...p.O~~>.....%KhK0q.CHEE.........,...aj9g.....c.***...~)l$...g...O..q.CX#p.7n...$.'..<..]..D:.U.[.z..9..6m...$...`..p.B....7.T.[..|.2..X.`....-@..... Na..wp..I....!.$`5....ni..FW

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\AA1elCIp[1].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                            Entropy (8bit):7.425488218397858
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:6/Xvb6/5E16KgNqt2vQ4Fg7A6+ttvnHMk:6/sW1+UtSNFg7V4tvnH
                                                                                                                                                                                            MD5:35B80C382499C72375758E647B791BB0
                                                                                                                                                                                            SHA1:EA4EA6C96FBFFD517EC2A79105F4A23F08E8C883
                                                                                                                                                                                            SHA-256:AA3D754F75F3B9153D6240361CD8A3D6A19C28251A639915FC5AA898D062D212
                                                                                                                                                                                            SHA-512:EE525B1C0554E0FA640AAF571F36F8B304F8669C533F5F2445E4F9A472BE1F225EAA0D750539DA09EE4EFC91801D43DAD03E38AFB9D745FBD230A5D0BCA14321
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`................................................................................................................................................,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.. ...;.Z..n..\.]............4]w..o....e.....4]w...:?...?.&?.u...M6.../-n$.vE2......;!=..(.Gy1c..F...."$.#..........4].l..V..4...1v...$...+.2..<.?.1h........K.=...?...1i.Q{.......|A.x.....>G.4s........~..i_O.G.4s.......x.J./#...9..,.85.:.....X.]."H.Y}A."....oM.}k...W.h.....3...B..#...A..|l....K.......G..M....v........Q].x..c..,...s....4..~.~.....mj..fH.#.#....IV.........J.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\AA1i0jET[1].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):65536
                                                                                                                                                                                            Entropy (8bit):6.12073557077176
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:6XKtsiv3+38JKJgO7ezsqWP0Eu59xW+1s7dYKoH6Q5R2B/z:6QF+38JKJgO7eg/0V598Gs7d8H6bBr
                                                                                                                                                                                            MD5:960818F2CEBB5AEF0F5D62D04CB3163F
                                                                                                                                                                                            SHA1:FCE62F6C124F54F389024D6C1A524F64D2B9C7FD
                                                                                                                                                                                            SHA-256:418D726E41CA7E1C85353CF96C95262FA858751B3778789E47BA3398169AA0C6
                                                                                                                                                                                            SHA-512:E4B285ACF9F0E36FFD08701F1E7200AF425B90B253FA02949A65C855AE59F5F2475735CF5B240316E13C764B44AB1EF267F1F19846FC87D6BBDA7CE6F12E4A34
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`................................................................................................................................................,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...._.4...1......._.O.........*.jR}...X....z<g....B.O~?..c8.te;.6.c.N.........*.+A~../..X7..M.e}..d.n+......5..w.I.'..8..sz.)4`_A.NY.t..sn....6.,t.).K.@..p.+...u..}.N...>"Y.../+\\,.HH...Z.;-...5..<.V'..G!.4...:.......F......>o....^pqg.Nv..W.<Kq.....F~.j.....a....P.^}k.ET....F.R..tw..5wI..L...P..o.ka.;...If.g'..X..i.W.]ENSW..l...Al..n....e......$dm`3.v.r...W.^..v%...

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\AA42cl9[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):371
                                                                                                                                                                                            Entropy (8bit):6.771619399520493
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:6v/lhPysQHMkXXgjnDi3URj9DxFeT/wfqddXWNtaQAwx20SHdEqfgeB3ScVp:6v/7wH83nDDeTYwmKQLMBYeB3Z
                                                                                                                                                                                            MD5:6CC41C487BA6D1FA16A058E7F15604B0
                                                                                                                                                                                            SHA1:C02C61F59349DED8B2429AD68F6530C34334696C
                                                                                                                                                                                            SHA-256:759513794817F448B8F7FE0A14A246062CBAC036A64CB6B5A856B38518AEA5F0
                                                                                                                                                                                            SHA-512:2AB595338D17E63D06F972DF1A03BE3834A5AC688F8BA698B8FAA05BDFC918316926D7B29F70C155C7708E7E19264F86E1D3897BF3D59018B9CD54A6D0B82539
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs...........~.....tEXtCreation Time.09/28/12.$.Q....tEXtSoftware.Adobe Fireworks CS6......IDAT8..S...0.. ...... #d...N..:B7.:A<BF....x ...B...I...... ...7.."p|Lx.k3C.yW........:..TU.`..fF....s.R..u.4MOoTyP.G.9.m..=x..I.)"U....eA.. .UE.w...I..0.#......O=...f.........PJ..y...SJL)1.X.....N..r.B.....IEND.B`.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\BBUvpML[1].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 192x192, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4], baseline, precision 8, 16x16, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):941
                                                                                                                                                                                            Entropy (8bit):6.976699709097011
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:QqJSk/ehpK2o0XxDuLHeOWXG4OZ7DAJuLHenX3LZMeYQE/grQ:38k/zuERANuZQEYrQ
                                                                                                                                                                                            MD5:4C107602B0444C92F80651676F732E94
                                                                                                                                                                                            SHA1:C2F042E84982627F9E2BC9F32D6A7561138D86D6
                                                                                                                                                                                            SHA-256:8F3ACC4F0FEF4D88F5A7BD0728D4697E56FAFEDC692764A55FC78865850673F2
                                                                                                                                                                                            SHA-512:2F6DEA4C98E4A63A2FE9764C75C208D49C2039F81368B72671AD5A0B3F17F87CEDC8C45D47C0241E3506AB19F7CF1BFE2F7DBB50377752AEE43BDCDBC53ECB6E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.............NExif..MM.*.................>Q...........Q...........Q..........................C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....o.._A...G@.%....{.w...."y...E.|..#.YL/<....d..n...P...&.....n.]5.]....u.\..i..i.Z..a...R..l-.bTwm...P.T......m.......<.w{....t/...m4..4..>...J...>.pI...?.?n...c.{...o.^#..........G*[.i.........}....[C(`W.(...........y....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\TTY4BA68.htm

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:HTML document, ASCII text, with very long lines (58382), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):190966
                                                                                                                                                                                            Entropy (8bit):5.460818853551479
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:nI9wUwMa1ar2FtZmVL3GDoTt8GxHLiE25AglWG4g6U5NgW8uaw3duORA/FpNnDAT:I9wzNFD4LWDoRLk/h5NyhwNuORAK/xYU
                                                                                                                                                                                            MD5:D69593433C26F3D104DF47718E63E0C9
                                                                                                                                                                                            SHA1:6EF924422390EEC6C8EE542B152F115046007F25
                                                                                                                                                                                            SHA-256:1D43FDA8EE8165EED0295862760B1247AADB8121B0635914BEDB71FF6D7393CA
                                                                                                                                                                                            SHA-512:729FB7EE333AE25E5C90092CD4B374570400256EECFD792F205F7374724965CFD2A5D68ADFC56638CAC6B912BA622485B547C578FED83B9F29F996269B66C027
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-tat-msnvserp-t,1s-msntovserp,mms-sc-sc_con1,prg-c-visser,shp-xap-gr-ps,prg-sh-carrsb,prg-sh-enitlea,prg-sh-enitleactt,prg-sh-genreco,prg-sh-genrecocreative,prg-sh-genrecosubkeytest,shp-xap-gr-noux,prg-1sw-sa-qryannt2,prg-1sw-sa-ltmig0311t,prg-1sw-saql2restrictedt1,prg-1sw-sa-l2prerelvft4a,prg-1sw-p1size-inf-wm3,prg-1sw-infiriv,prg-1sw-p1size-inf,prg-1sw-p1sizeinc,prg-1sw-pagefilter,prg-1sw-rivactsec,cg-rr-ctr,1s-eaop1,prg-sh-badgewc,prg-fin-chl,btrecenus,iframeflex,prg-adspeek,1s-winauthservice,1s-ntf-hisenc,prg-1sw-samhibrnc0,prg-cg-uxprod,btie-fancy-img-t,prg-ad-ai-imgf,1s-fcrypt,1s-shp-xp-ectocnrich,prg-sh-ectocnrich,prg-premier-pr1-t1,1s-xapentprong1,prg-1sw-pro2pre,1s-p1-bnw6,prg-1sw-sa-bnw6,1s-ntf1-fyrvt2,1s-wpo-pr1-ifpsc-efy,prg-1sw-brnsspotbd,prg-1sw-fynp,prg-1sw-sa-fyrvt2,prg-1sw-ccl2-gbg2,prg-wpo-pnpc,1s-wpo-prg1-cnsimplify,1s-ntf2-fyrvt3,prg-1sw-sa-fyrvt1,prg-pr2-fy2tit,prg-

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\common.3864859aea200a56092d[1].js

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):285935
                                                                                                                                                                                            Entropy (8bit):5.423812349396232
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:jGHopYqziV76+YrGW8yhxlFQ/uMBwX1KSU:jSoKeiV2NrGVuMvb
                                                                                                                                                                                            MD5:D98F620892FCC7698665E9EB43168F9B
                                                                                                                                                                                            SHA1:675B74FBAF006D295DC82317519788D526CC8C60
                                                                                                                                                                                            SHA-256:93B6652EDADF118219BB4F0781A17F15CE3D7B349FA0F1011BDB0B5224C94ED8
                                                                                                                                                                                            SHA-512:06EF77D6802FC8D4BA2D6BB1F96519A7EFEFEC177415252CE3CB2D01643427FEF131A27F9AFF59DB299E73F01AA8D206E459B8C63C574318D9385AB6894481E1
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences||[]).push([["common"],{54085:function(e,t,n){var r;n.d(t,{p:function(){return r}}),function(e){e.Desktop="desktop",e.Phone="phone",e.Tablet="tablet"}(r||(r={}))},21290:function(e,t,n){n.d(t,{GB:function(){return u},Km:function(){return l},Oq:function(){return v},Sp:function(){return g},Wc:function(){return d},_d:function(){return p},cm:function(){return h},e_:function(){return b},kJ:function(){return c},oH:function(){return m},r7:function(){return a},yG:function(){return s},yL:function(){return f}});var r=n(33184),i=r.z.Alert,o={build:""};function a(e){Object.assign(o,e)}var s={id:22010,severity:i,pb:o},c={id:22011,severity:i,pb:o},u={id:22012,severity:i,pb:o},l={id:22014,severity:r.z.Critical,pb:o},p=(r.z.NoAlert,{id:22021,severity:i,pb:o}),d=(r.z.NoAlert,r.z.NoAlert,r.z.NoAlert,r.z.NoAlert,r.z.NoAlert,{id:22027,severity:r.z.Critical,pb:o}),f=(r.z.Critical,r.z.Critical,{id:22031,sever

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\experience.1287eb605f92d676502d[1].js

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (62058), with no line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):234686
                                                                                                                                                                                            Entropy (8bit):5.768283217926616
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:r7c/ckbS2b/pVQAWjhw3d3qWnQHdRJg7hJ5BjHnatGJNyWVzskPNjlqAGu/gzxKb:fvkbPug9MmyWsard/KJb1rNA
                                                                                                                                                                                            MD5:6AAE93A7CCE3FE8BC016C5F4831472DC
                                                                                                                                                                                            SHA1:5FC3CE2919A27837CD1848084413E965D658A645
                                                                                                                                                                                            SHA-256:B650CAE4BA73157B7C226CBF03D86804774B35563BA24B79AF644BD45F749FBD
                                                                                                                                                                                            SHA-512:ADD7B13ABE7B2AA799263217AAD8806C607B3D384E151C69E47F81585D15C637FC16C4679A258393AF6FF89E26325AB61F5FE06278A5A7CC1996BB74EF412042
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:!function(){"use strict";var t,e,n,r={12451:function(t,e,n){var r=n(8460),i=n(2132),a=n(82589),o=n(9925),s=n(96838),c=n(56595),l=n(54616),d=n(82512),u=n(98182),f=n(8488),p=n(30786),m=n(4108),g=n(23159),h=n(65212),v=n(87738),b=n(54085),x=n(3460),y=n(91898),w=n(42390),k=function(){function t(){}return t.trackCallbacks=function(){switch((0,x.Bn)().currentColumnArrangement){case y.K$.c1:case y.K$.c2:t.viewType="size2column";break;case y.K$.c3:t.viewType="size3column";break;case y.K$.c4:t.viewType="size4column"}return t.viewType},t.getTelemetryProperties=function(t,e){var n=!("false"===w.c.getQueryParameterByName("enableTrack",e)),r=w.c.getQueryParameterByName("ocid",e)||"hpmsn",i=u.jG.ActivityIdLowerCaseNoHypens,a="0",o=!1;if(d.Al&&d.Al.ClientSettings){var s=d.Al.ClientSettings;"true"===s.static_page&&(o=!0),a=s.browser&&"true"===s.browser.ismobile||s.deviceFormFactor===b.p.Phone?"1":"0"}var c=u.jG.CurrentRequestTargetScope&&u.jG.CurrentRequestTargetScope.pageExperiments?u.jG.CurrentReques

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\me[1].json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):90643
                                                                                                                                                                                            Entropy (8bit):5.33295148310279
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:eJ/PQ+jPaPhQqNAYOalk+2oLObEWQGD2kR3tqdOLl62A2SShM34l/ex48YLRQdCj:eJrj+UEWsl0Gky173SiFevtRlpf
                                                                                                                                                                                            MD5:035E2437A63AEC1AA6F309C3BE5CAEEA
                                                                                                                                                                                            SHA1:BF5B5659139CB75EEB697D69ABA14D20AFCE5417
                                                                                                                                                                                            SHA-256:A2DFFC040481E3ABA5BAB75BF7A61634BECC23BD5762234CA2404032A1E1C671
                                                                                                                                                                                            SHA-512:99F7F119AABD80D5789B812C9580DD362971A5A2C34A664B9B613416623A32BE3A5796214C954B5451263B1842A9CE56C4D4A6BCB02AD4BD60287F37BBDECF5C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"nextPageUrl":"https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=bdae20e1-5559-4e16-b073-c730c4ead932&$filter=_t eq 'CompositeCard'&contentType=article,video,slideshow,link,content360&infopaneCount=24&queryType=myfeed&location=47.7159|-122.204&ocid=msndl&apikey=Io4orNtwRr08vQQBER8stWzJbGltMJzMwkmiMOv9z3&activityId=7FF05383-E874-420B-A4A9-263700520B95&responseSchema=cardview&cm=en-us&timeOut=1000&WrapOData=false&DisableTypeSerialization=true","subCards":[{"type":"infopane","subCards":[{"id":"BB1jRrkS","type":"article","title":"Election disinformation takes a big leap with AI being used to deceive worldwide","abstract":"LONDON (AP) . Artificial intelligence is supercharging the threat of election disinformation worldwide, making it easy for anyone with a smartphone and a devious imagination to create fake . but convincing . content aimed at fooling voters. It marks a quantum leap from a few years ago, when creating phony photos, videos or audio clips required teams of

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\thEAMNYBJ5.jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):15173
                                                                                                                                                                                            Entropy (8bit):7.961913697119796
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SsE7AdbpLhBsMdW/wPQF9erOmv0ugE7c42x5e7Lf:Sz7Sb1hKM14F9erOmr7n7Lf
                                                                                                                                                                                            MD5:C78108E244686480775ED17AD21CD2D9
                                                                                                                                                                                            SHA1:9645F844565586182ABD3F3B0FDC4F028BF90A73
                                                                                                                                                                                            SHA-256:BB4E845FA4173A36DA3FAB9ADBCA9EF0175D2063184085EAFC4EEA9ED6999D22
                                                                                                                                                                                            SHA-512:CFC9DEA20B39FA7577BB7F497F1E011A2778363F1B8BDFA0FC948AB558FE2C9C82F4B626C74FE819890A45C9ED47C0400728362173008B2DD5E6A7053409E81B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..V.!....V9.f.V......[.p?.5...f.....B.Ua.t....9.-y.0 .......Q:.SC..ip.UKc.d.,r.X.q.....`i.A..#..D.W.\ .8.v.2...q.2...GQ.B.(.!.F.,.....x. ..s....|?....z<.f..[.Q ..ds....[.^.........+...c.[.....x..Z.X..N.t..U.:.g..oF~.2.M5*..W.....|$.....s.....l..#.s....W...:..q,..2].Z..-..=NK.@=>...i.......~ ..(~.Zg.E.o.c...s.]O.O..h^..a.y.K8....=.u.e.8..Taw.3....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\thQS2I08ZI.jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 620x304, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):34087
                                                                                                                                                                                            Entropy (8bit):7.956342273215838
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:R8XZJwVBFCEdwb1iOmqKE13D10BcG+/tJ4G7mrwGZJry:R8XZ0zjcfymDlG+/tyX9e
                                                                                                                                                                                            MD5:2F982D0552D22404565016B636D967BE
                                                                                                                                                                                            SHA1:5B469B80A99A17026218B7386D28D72F5AA4E01B
                                                                                                                                                                                            SHA-256:15FA19800896339E6B716EC87ADC639F5F077ECAF82A06DA4B6B7434EB1F3B7E
                                                                                                                                                                                            SHA-512:549C53C851F31BAB86C3905AF8EA10EE7127D19441D51DD11E5CFB3F8630414CEF78ADBAF1BC53EBDA4AB733FD9B1FA641CADF902ADF99791968D009B45329D8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.......................................................................0.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......(...(...(...(...(...(...(...(...(...(...(...(...(...(...tH..Tf.....9e.H..r:.Y\...H.....#.].|..k2[...].2}.3.%......*+.....N..]I4........O$(a..d.$..^.=.9.A......h5......G.H..(>b..%1....+..t..F.6..7.<..n.?C]n....rBLrG...*...k/o........G.Vp.!...T...........i?..R...,.c d....`.b...x...T9;w.,}..R. ...hQ.n.........%.....M.4.|._.. .,..3...L...V..9..........~.\.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\th[1].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8413
                                                                                                                                                                                            Entropy (8bit):7.927493399273415
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:SLhT/RoBDoB83vEdC59wQkapR0ADq33PWDbsQVy:StSBDoavEg9oakTPWDbXVy
                                                                                                                                                                                            MD5:9E0DD6FCCB42E24766A76D3E20DB821A
                                                                                                                                                                                            SHA1:7470D0A5494B78EEDC7221DD58D321D470B0CE67
                                                                                                                                                                                            SHA-256:9548965957503EF00A3DFC71FCB9A4B743F1EE793C52C9625D31362DD3E6604E
                                                                                                                                                                                            SHA-512:61D1506729503E053A06E83534FA2115C6DD20136F03AB3F5DB75FE1C8EDF16FC48B8FD48F54C351DF5E8204C046E6D7332C823F6BF1E3CB448C058DDE41BDA4
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....3RG.i.=....VF..RGQv..R/J..zT.[....C.#.*.....:z1-Q.^.).".r..Q.#......Fi.?.)0{.Mw.Ou$..u.F,.fa.....u._.S.\....4.c.)I......Y...6......)<....G...V.2..w.1@.OU?.N.A..v.*..+0...i.C......L.D..}.H.Sl....=A...8?a....{.!.OlF...kZ...O&.......h.S...+...w.C8.)...Fj..].b..o..v..Zb....{...5i{.?.?..n. 6x.v..g..}..H9M..h.}+*.d9....,..P^[..17..7B.h.SN...A}..-..E.....5...

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\th[2].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16109
                                                                                                                                                                                            Entropy (8bit):7.957405475656724
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SqYbJNGtoqeLxU60t8znE4p1a1b3LIfrJbWkPvWbR:Squd1U60taES1MIZ3C
                                                                                                                                                                                            MD5:297D5231FFE7FDFAEFBDC96158704D75
                                                                                                                                                                                            SHA1:57B7248186CC9D463F6FD85EF97700CDFCE36605
                                                                                                                                                                                            SHA-256:91CC8CC7608A6C041CDCC76BCD5E976F65B658050CE9A2B406D61EFBFC051AF7
                                                                                                                                                                                            SHA-512:6C2858DB53CA393BBBEAFD94977F0B130BA7580ED57CE53F3D2C168C0790E1734702617600B1FF5FFA5A056EBA111DEC56E4C6277D6FC2847B9466B9A2D9ABB8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......(...(...(...(...(...(...(...(...(...(...(.......PO.......\.t..v]$.`.X....O.\.....7\q.8?yT....V.....T..X&.....'.Y\$q..gbp...&.>.*..Ak..7Q.[C$.L.#.5,...(..I=+....>..$zn........~x48.X...c.#..r....&....F.O..P...4kv.%N<...P.|..Kw~..t.,.....p<...{..t....w............}..._a.p.I.T..n.y/.w.g......t.GL......|M..H...g.-...c#... aq....s.....Cqm?.4..Z..Wh.....$^.)..A?R

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\th[3].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):20715
                                                                                                                                                                                            Entropy (8bit):7.960604922761661
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SM7/KMP9kWAZecKuYxRUWu8bzdkmY6AIjH8zgBspTVTO2ddc:SI/JaLQKWu83dCyjBjsK
                                                                                                                                                                                            MD5:400CA80D7D38B974A7E7251FDB920699
                                                                                                                                                                                            SHA1:303B92766C782CC77A5676BE3CA2E8584E33D227
                                                                                                                                                                                            SHA-256:77E61004CAEACFDC54D2B4159AC736151BF080644B933732EEC54767092B5E56
                                                                                                                                                                                            SHA-512:D0ED1BC5A6E35C0247D8194320D4B08043521B029D75CB1DE6634566879F1717905DEE935C65AB76B6C290A54C986F0483CF538AFB76D3C32C8C28AA6F163F53
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...>.Z.i...U.......'...<.......ZG...Cj.._.o..&&.`.q....N.....6.Y..0#.u...?._...:.......W.l:....!D.+...z.Q.x...:..x#....wv.t0.....i..Vbr{V..FwG..G#a......h..iv.-.)...s!.P8.=H.]A..F..H'!....g.h.Vi..o.....s.v. ..y..^<.E....c&2p....q.i.i0......3t?..M..yV..RH_j...m+c..w.#....H.@.^I>$.+I0R0s...B...^0....6.c.X...K.....8..h\l...{.9]... ....d.i6.o-.^.)..<.P..2......3.{P

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\th[4].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):17075
                                                                                                                                                                                            Entropy (8bit):7.968098652558124
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SW4M7y2IPUmcB6YebwSNJpMWh2+yOP8Bbiz6QtAd1QnBrSYHWay:SuO2IPYgnMSNW+yOPQz3mgYHXy
                                                                                                                                                                                            MD5:166031133FAFE375731A1CC65B0E292F
                                                                                                                                                                                            SHA1:79829C11D7EA70BBFF618232C1FE1845D9C2104D
                                                                                                                                                                                            SHA-256:5CC3F14642D2810B1F1BAB35EBE51B2C415EDF23F23D977C8744FFE100558786
                                                                                                                                                                                            SHA-512:EFD884FCD391BDB8AF4A2931367CF9208CC899EF79CC694D3C60D1D23329BF5F4FB82561585F28DEF467BC67335CBD03BA62E4269756C66D706A159C9606FAAA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.._.|....tk..5g..Lj(......o.......<.W.I..5....Cj"".+.a,.'f........r3...ee2[.Imiq.V...).....n.F...'+...A..|.._|).$.U.Z...w.PZ....X..5.yE.gp...$.N=Z.z~..:X....S......v.aCcm....J..".@.#M...@P.J...C]....4_.C.-rh5...!1...;.<..... ...pH.....$.....%.. ..=.R9.H....9p..+./\`..X...B........f.L.f..>..p>pB..p.I.......Z......%..M...f|.}m?..c.................d...av...8.k].

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\th[5].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):23901
                                                                                                                                                                                            Entropy (8bit):7.96556860722461
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SeP6BLYz6IP5L56mZ63HYW6KEk7pRV4g3kK9cPMvz9QOTaX7996JHg3J1:S869I7tfyag3FcPMvJnabEHe
                                                                                                                                                                                            MD5:DAE74229C37341CC56FCAB61E6A8740F
                                                                                                                                                                                            SHA1:4BE2AD550F3E9D0A600AA593CD0365F6318D4A03
                                                                                                                                                                                            SHA-256:1C24BE0F0481870321813718C1AB7D8F31FEDDDACF7AFC6516C278EA3B7B298F
                                                                                                                                                                                            SHA-512:0DA290687D83E44949EB18109CDC0A06628A2DC051611C68B9B824A4DFA9335881CFABA5A87A854E28AFC695BF2D43686B45F0855E87A4BAB2F69196193FB3BA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....Q.....s..~...u...W.~j+.e..k.u....8.FT.7@i..t,.C#.c.##'..O.I.....f5gH....=.Z....Nd*..#.0S.T.;.q...,.E...3$-..P.`...j%.(k.6..C.V.28.P3..3Xnt.l.q....(..0..L...b.._. .....Ok..A4aU...!9;.9$..=qV.....F.8..~..J.<..3:.a..s.gVr.+6.......e0..U.QX...V..(.H...G...?SZ.l...M......dv.=.c.5./.....(.a...^Xwpz.9.GFM..#..z.r.i.Y...is.m.Z...Kx..z..p..>z.K......<......q..t..w^.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\th[6].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):27990
                                                                                                                                                                                            Entropy (8bit):7.9650944221404965
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:S9RYbDWI2KyizSlfSatWEshDtGurLo6/aSRhYj7LHLSreds9n49Hbffdkg5f9Qjc:SHAVyiz0KatgDPLPxg7qWsZybndkiWc
                                                                                                                                                                                            MD5:FD39555F27CA037F111D52575F69E48D
                                                                                                                                                                                            SHA1:AA5318FF0C5C24BA20DDEA9E2B022FEA87286537
                                                                                                                                                                                            SHA-256:5392AF1D27AEBE6A5786822BBE78D39D2FFF1CBBDD1944ADCDA134A6C6CFE1FA
                                                                                                                                                                                            SHA-512:A062F4BA50AA6983808E60345B68B72E1D8AB401281297787F22A4A1271AF0299CACE584BD61ED8FD91D3300A03AA20438BABA6AB9A5D8146B077011021B8376
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......2...".ol.1.%....>.}k....OF."..h..t..4s...GJ.9do.r....Ccc...X...?55..R..!O.gum.q..ywv.OL.4..o'...;..4.<...&>U4..npTz.....h.v......k{y/db.....K..=.....0...........|..Q..0.,x.....m.j....Ci..m.8...y.....t.I.,.....p3...9..2....db.w....D./...'..z....l.x?.Cv..o. .........5..[S].w,"...Q......k..}5..M....m%.K..`.F6........<...|.a.2.|o.j..[..@A.`........;[..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\th[9].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):19980
                                                                                                                                                                                            Entropy (8bit):7.960218497912246
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:STmec7AsmJAkIUHFAS/t1/3Il/t5NJNU+6aWCp1EhUPOkcAU80ugcY2bErJkLnz+:S6VAsOAmqScl1ZNT6a2CP1cc0ujwuzrS
                                                                                                                                                                                            MD5:B805A518417ED50F6687DA5266231120
                                                                                                                                                                                            SHA1:D543933353EBD16E45FC0978A77DD707EECB40AD
                                                                                                                                                                                            SHA-256:648AE3D1E77481313785822EC9ACF25D4A8A2C8CA3537165619A4CAAB127DB0D
                                                                                                                                                                                            SHA-512:4284CC7E33343859458E6D6A1C11791C0E340D3AD6594041E8FA3D1BAEA3321BC2442464A04EABACDC367B49D2B37E5457BA8FBE5C2A24F6D14114F768C5C3B1
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......(...(...(...(...(...(.H#.+o..YC.K.a....HcU.|".I...n..f.._.Ff.\b(...F........5..-Jk.-5.r}MR..h,U...c....n..F?4..(..h'........i.eY"M...$.A....Rq.;...l.xv.V.M.h....... s.w........dd..J.`p..Nz.Q.T.W.M".O.!.@.#.l.dl.......'...N..m..Ck.....L.>........AE.:@.FUm....}.(..y.....]4..VYY...a...;W.l...pE:..q.)zO.,......U..v...T.W.8.<q(.1..q......1....h.:Z.4.-..a.-.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HGDHII9N\vendors.79af82f3c5b028c7ea81[1].js

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (44421), with NEL line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):196564
                                                                                                                                                                                            Entropy (8bit):5.416918453049597
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:5yggyMjcPJF7iol0cQtK7bKXZ7x7/3DwLqsop:5yggUJN3CE7cZ7MnQ
                                                                                                                                                                                            MD5:87B6340D5C378650AB6B6DBFC2FCC200
                                                                                                                                                                                            SHA1:42625DD447DD664F0078D831A020BED9A71A92A1
                                                                                                                                                                                            SHA-256:27F89E7501CE8BF61E542F918284E6DDA03C31ADE11BD4B2174AE34D50EAABB3
                                                                                                                                                                                            SHA-512:1BE5C0AD1109FF789A1D1A7D1145C1421E756A26D7350F512C0434DFF1422477EA36DA6BE886556CAD37B75ACA5942A10E6E71761A87263151419451487E5EE6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences||[]).push([["vendors"],{29558:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},74322:function(t){t.exports=function(t){if("function"!=typeof t)throw TypeError(String(t)+" is not a function");return t}},25135:function(t,e,r){var n=r(26397);t.exports=function(t){if(!n(t)&&null!==t)throw TypeError("Can't set "+String(t)+" as a prototype");return t}},6664:function(t,e,r){var n=r(23362),o=r(35093),i=r(79549),a=n("unscopables"),u=Array.prototype;null==u[a]&&i.f(u,a,{configurable:!0,value:o(null)}),t.exports=function(t){u[a][t]=!0}},99027:function(t,e,r){var n=r(58306).charAt;t.exports=function(t,e,r){return e+(r?n(t,e).length:1)}},57699:function(t){t.exports=function(t,e,r){if(!(t instanceof e))throw TypeError("Incorrect "+(r?r+" ":"")+"invocation");return t}},45150:function(t,e,r){var n=r(26397);t.exports=function(t){if(!n(t))throw TypeError(String(t)+" is not an object");retur

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\5B0M48KI.htm

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:HTML document, ASCII text, with very long lines (58200), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):191148
                                                                                                                                                                                            Entropy (8bit):5.4624941891884
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:nIGhqUwMa1ar2FtZmVL3GDoTt8GxHLiE25AglWG4g6U5NgW8uaw3duORA/FpNnDW:IG0zNFD4LWDoRLk/h5NyhwNuORAK/xYU
                                                                                                                                                                                            MD5:43F246635BF8B5C036C7BD374A6799F1
                                                                                                                                                                                            SHA1:496C157FA30650014723AB396EEA2971DFA52897
                                                                                                                                                                                            SHA-256:F68A89C24EC79799E887AAAE0A279FD5B2A64277F6236A5E517F2B6BF66A43F3
                                                                                                                                                                                            SHA-512:A65191BA071A8B9A5FD458A4BE4DFA99AADAAF3D855C98ADCB3526CB14246A27454590E07719CF723CABC5F4FB3E39405879B50CFF08BABD9D10207E137F8868
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-tat-msnvserp-t,1s-msntovserp,mms-sc-sc_con1,prg-c-visser,shp-xap-gr-ps,prg-sh-carrsb,prg-sh-enitlea,prg-sh-enitleactt,prg-sh-genreco,prg-sh-genrecocreative,prg-sh-genrecosubkeytest,shp-xap-gr-noux,prg-1sw-sa-qryannt2,prg-1sw-sa-ltmig0311t,prg-1sw-saql2restrictedt1,prg-1sw-sa-l2prerelvft4a,prg-1sw-p1size-inf-wm3,prg-1sw-infiriv,prg-1sw-p1size-inf,prg-1sw-p1sizeinc,prg-1sw-pagefilter,prg-1sw-rivactsec,cg-rr-ctr,1s-eaop1,prg-sh-badgewc,prg-fin-chl,btrecenus,iframeflex,prg-adspeek,1s-winauthservice,1s-ntf-hisenc,prg-1sw-samhibrnc0,prg-cg-uxprod,btie-fancy-img-t,prg-ad-ai-imgf,1s-fcrypt,1s-shp-xp-ectocnrich,prg-sh-ectocnrich,prg-premier-pr1-t1,1s-xapentprong1,prg-1sw-pro2pre,1s-p1-bnw6,prg-1sw-sa-bnw6,1s-ntf1-fyrvt2,1s-wpo-pr1-ifpsc-efy,prg-1sw-brnsspotbd,prg-1sw-fynp,prg-1sw-sa-fyrvt2,prg-1sw-ccl2-gbg2,prg-wpo-pnpc,1s-wpo-prg1-cnsimplify,1s-ntf2-fyrvt3,prg-1sw-sa-fyrvt1,prg-pr2-fy2tit,prg-

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\AA12I8qo[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 96 x 96, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1287
                                                                                                                                                                                            Entropy (8bit):7.753286328828527
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:Qkmkb13K52UTcyiUJlRq85hww6qJyPGbh166BaK23P:Qkm613KsE+oLDBrJyPGbD66d23P
                                                                                                                                                                                            MD5:9B8059391E9315D157357A18A6A0191B
                                                                                                                                                                                            SHA1:C466111C02D867C05CD522F2F362CFC23FA22B9C
                                                                                                                                                                                            SHA-256:379BC8D28440A12EA8A540917610C7B6A2B865CDA7275285FF922D69CF46B5E7
                                                                                                                                                                                            SHA-512:CB19000C7425C1CF8DDA9A8D10DC220D4961D34AD9B837E4DABF2C649D57223F0497D344671782E4F4782BDAD82B06CE702E27D67F2176168DA619985BAC5848
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR...`...`.....m..o....IDATx..]l.U..........MD.ra.h-.c....?.F.T....@..ik......6.......pC....x%....DJk.......x..-.......$.......w..U........ :R..)....@.b .1...HA.. .R..)....@.b .1P..P.<.,+.nB].p&H].rI....G...D..<..V...~;...z..w..?..%V.~c.z...B..=(.z._V.3.=\.)..-%......w1.]e..8.P7....kC.j.......nhT+.H..B4(..Zg..$J....I.W..:{..S....VC...74.....^,..6X.....8.jX.W.._.~E.....w. .....e..x...kB....z...3..?..m...z....d.......g.D....n...q;GNo.3N|...%.._V.i~.....!.@p.E.k.[.(..D.lW......$H..Q$A./Z....jz.K........-.G8A.B5....P........q..-.a.)..u.U.a."..../..4.Q..X.....{........$, . .....+)...^..+.U..fz. ...-$.....#n..j_..z.Pe..O....ts....w..B.........F7..(Zq1...{.q..w.._.,.Zk......T.H....,.<.h.g.>...........f......%7...l*T.&..ykrr:Vo.S...f....S..~#j..A1........C9I':.......t..NO.......,..b..e}g..I[c..7..Y...B/.@...8}.....!...7.b..N.c.......m.pz.E....8...... =p$..A..s.K.......M...B:...q..W.O.`...;....E.......{.P..... ......-.....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\AA15YhMq[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2013
                                                                                                                                                                                            Entropy (8bit):7.81099098044133
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:qcPmqB8c1a5ShKNuK/z3amAq5zGQy7EFUQ9:J178ohKNuK/zLwQ9WQ9
                                                                                                                                                                                            MD5:1F3C2A6537F6260FE81A7CBFF4BC431C
                                                                                                                                                                                            SHA1:E779F157168D274F1FAB870C85349C9A9F9466CA
                                                                                                                                                                                            SHA-256:31D6A3E91B525A985991C7B179331B814C77B54193D22E594B09018FD7AA5637
                                                                                                                                                                                            SHA-512:A3004D5701D6E88D35B5F946A26D0C893D681E9F8651C7E0F0996CA85048685C37197BE975C8E9AF3825F77A5582ECEB246687851EA221837770A8DF257DE599
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR...`...`......w8....sRGB.........gAMA......a.....pHYs...#...#.x.?v...rIDATx^..K._.........n...h..._.T...c...>h.J.OD....c.]....[..4."".B....`..^..~'.>3{.......,.k..3...g....,....CX..c.0...0V..X..c.0...0V..X..c.0...0V..X..c.0...0V..d..vy..)....-j.\..V.^M^x.].._.|!/<...0u.T.={6,Z..f...D.>..........l.......b..i.QM..l..9z.....E.-.Y....Q...,//....^.-.F..............h.@..g....V...SO..+.<.>}.s...'.L....]....3.ah...l.....=.:w....q..}...'/..}.6TUU..OiK0Z..........fNQ.0..oa.....+....D..f..eT...L..T...t~..AG...3 j...0.....r.G..A[[.y>......X:..Xgg'..'.3............m.pww..*.c....E-.eee...3..Y.l.444../.}sg!..;w..'...#G.@ss3y.\.4...6..X...3.0u.b``.9v.;.e}....z..E.....aH...O.<q..'....l....r..i...K.....\,.p....I[....Z...(...w/v..u.`.}.!f...,..E,.....L\.....PK.._S+...p.O~~>.....%KhK0q.CHEE.........,...aj9g.....c.***...~)l$...g...O..q.CX#p.7n...$.'..<..]..D:.U.[.z..9..6m...$...`..p.B....7.T.[..|.2..X.`....-@..... Na..wp..I....!.$`5....ni..FW

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\AA1lLvot[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):3532
                                                                                                                                                                                            Entropy (8bit):7.898834558255451
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:C/6rD86PqmSUC2jKD/YDIkYCsPC7eKckLHvis8aVyt51nl648svBInwA9NunIbQx:CSrXzC7jY7l+U/ckLPiaG79vQMXYRLu
                                                                                                                                                                                            MD5:47D01EE8DA7EF964B63B713A8562EB5F
                                                                                                                                                                                            SHA1:742B956BD1BFEC102353CBE7050A99B8046A1A50
                                                                                                                                                                                            SHA-256:FCCB19F39DD8A2AB0B87B212A020B5B61CCC954505DC8DF3799D9779382F0E4F
                                                                                                                                                                                            SHA-512:BDBB9A109E4E39B885A40F91A5E2183443036B4B84B014F6A857645FA622DCA3A59C3B5B4BE100174E609216E795D5E01E4F04FD83BE490648571AF8358589F0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR...`...`......w8....pHYs.................sRGB.........gAMA......a....aIDATx..\.p.....>..."$@.+.....@|.8M.....2...@..../D.2.QQpFh.%..Z.I.[..tL.P..(..I..bB...l..M......._f...=......s.F.|m.lH..lH.M.d..H.M.d..H.M.d..H.M.d..H.M.d..H.M.d..H.M.d..H.M.d..H.........8i^.A3C........}. ..-.....6z!..\M.2&Q.+.|..j.:C..*....:}M4\...%I..)..&2..B=#.8.G....s.'..7..1...=O..x...?..aA....;UW[XDQ.`.2S...Y[......l..$.....'Ew[......^..n....M)N.....X.w.u;Z..,fQ.o.S...v...S.,$.O@.If.(...#3...dC:.3B._`B.uF._`T.$...ihV....h..d2BF.....!.H'...D.$.;....k_.t..Y..: .:.A= ..*g.&............rK.m5$.CF..1]...a...o.;.`S...5._;T.K.....:v.K-...lN5U.:..4...K...+.....4.......e.i.U..`l.s.Pm......Z.?....X.5Ac.@...57......U....K.[.p.`.._.....).....'+ai...W.tZS..m....6^.u.X.3...@T;...ic........._..|...)|....s.......R..ZXG.wHW.M3..h|../u....^................Ku].....Q..eO..P.....v0K...q.....I6...../....|...e......i>..v...v..v...BL.A..X."H[.K.. .=^2.;z....9...d,..G.5.....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\AA2XNwp[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):416
                                                                                                                                                                                            Entropy (8bit):7.1065221343906
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:6v/7aa/6Tog8EAQsAHs23ApwmqsryKmaoIAOqZeeuz:Na/6BrucZwpwuxr3AOqP8
                                                                                                                                                                                            MD5:67310DA1C79C90D4D8DFBD215A6DD726
                                                                                                                                                                                            SHA1:AAD285EAE536058061757C87C91CAE0C94A90C84
                                                                                                                                                                                            SHA-256:1CFD9AF21E6171001952DF50E5890D563D9560590C4155A528F449953F7DEDA7
                                                                                                                                                                                            SHA-512:7CD5E205B6102A5DE5AED89454EE3F61A8C0F5CD881CC870D67D5CCCE5230DADA286911883D444B277DCBD5455FFCB2253A7056F15DB1369C7EB2500C672598E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR.............o.......pHYs.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.5........`}..$i.N..N.D7.(dk..d..%;. ....3../.~t...O_..s....h...g...x..z....|+....2.a.."....E...p.H.U.#l........&. ....C@N\D.I%.I.t.../^C....^...(N...4A^.......$.P:y....(..y.5...._..1.(..c..G...(h.B..D9..B..*S..O...~. .k...I.v..u2....d...oH6h....h..X.LY...A...`Q.\..3h.."......v.........IEND.B`.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\AAT0qC2[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):4403
                                                                                                                                                                                            Entropy (8bit):7.920463421474872
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:CSDbRvuYLph6gAY+EHysr4gUqql+90tOU47tLTnkWoZl2u6:CSDlvuYL34EHWZqqlC0H4RXR
                                                                                                                                                                                            MD5:B793F082CCFFD2B848D6DD1463315628
                                                                                                                                                                                            SHA1:6F2AF015E0CE8227C51F81190F85928E81DDF904
                                                                                                                                                                                            SHA-256:53449240A488DC721E154C880A64E8A79F86286DB406120F24D252CFB3E8B061
                                                                                                                                                                                            SHA-512:357FE9D636E719E63B8A45920017DCC1D8B31B9AC7E7C6AB2D54B19DCED1FE61E7433FE7E769CD55CFADBA1761B59B86610CB98DE10EE908D34AA66993F321C0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR...`...`......w8....pHYs.................sRGB.........gAMA......a.....IDATx..]l....wm.z.x1`.v0...J.T.T$..h........DJ..V<.....JI+x.T$.<..K....."....PJ.vZJ....;..`.....u.Y............fw...s.=3s'/)..d``......K.w'.........^......0..'..a,<`8...O..}*...........(...0.c..O.y...@^.AZ[[.{..Y...8{..4..-[........hoo.B._....7...#.l.Y~.\.B.10*........<H...s....f`T477.&.......0<.._Bx".>..C.dL.P...................[.......5..D.y...$j...VnI....L..+)<?9..w.}.k.5......v...4..hWm.L.H..........Jr,.j{/.....Pt8......YND..&.; 0.}TU.l....H......D.m`#-..../1.....W.De..../k......f.X..8p`NL.....6.`..T{!........')[.....j..v..6...I..R.(.....T.j.f....=.J.....`;..A...S.0t..V. .Y..C...A.q..;v.."C...A...h[.Fg... .~o.(.m.!@.....O4...#[..A.....J.o~..8.g.=.E_.....%'$.;i...M$:)9.O...q...)\...%+(/.l.\:.{..........]._J.P.j.*.&Z......(.....i...8Ct.......w......0...4z..M.w.n....,.J..[]..}..>........'.m...U.x.....".:..L. $..W..........G..;..)".N......?.P

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\AAy3CUU[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):18952
                                                                                                                                                                                            Entropy (8bit):3.347918954114546
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTpWvkiw3ay73aONGQUGfNXrNXVhsc5Mubxd6m:bSDS0tKg9E05T0kiU95zxdl
                                                                                                                                                                                            MD5:AE209DA8996159EB8B32BEF890806461
                                                                                                                                                                                            SHA1:F00684578491271F97DE59F3D9A95E28D82E791F
                                                                                                                                                                                            SHA-256:BB67572CE7734E367DCC3B90CDA6CEFAE27BD46E8662F84794E7476759145A02
                                                                                                                                                                                            SHA-512:F5B184726825B569125F6A8ED6A20BB4F1A2F18BCB13384F15AE6A526E81AB6F23C1FFF5EA8C1B9CB7C210FCD73C15CE1E7E9E257B6EBD69A50120F37E5DD167
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\BB1d0ujS[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 96 x 96, 8-bit grayscale, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1113
                                                                                                                                                                                            Entropy (8bit):7.727456978400816
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:6CdYQBAcBrSJs9tION6Gvx8nwpIZ/YCq46Ru3Nqm1NL4nz:6cYQBnPtLnx8wY6uJ54nz
                                                                                                                                                                                            MD5:AF5A688C4ACBA6C2E57518F2A93A36EB
                                                                                                                                                                                            SHA1:0FA67A1240915DBC819962263F2EFCC4380AB4B9
                                                                                                                                                                                            SHA-256:F5B1B30384C129ED683EC4B26BDC18D8EA02B58155B816CC1B646ABACFF06E53
                                                                                                                                                                                            SHA-512:4B17038A0CD1CC6491FBC9F13B090E64D0B99BF55CFF69CDD85BE73E9784CC55CCEF7EF39E1BCF6660AAC6763B98D1FD6F840462C0E85D857F9CF97DCDBB6204
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR...`...`.......(.... IDATh..IlMQ............J.....",.......Y.Z..HQ!] .....!R.`.j.M.t.hZ......g..n.p.;.yz....~....w.s..,.HC.+#...vt.y..?-(...{'.v.g.;`.2.6G....o.v........Ne.t...mr.:..1..P.s..N|z/..*a..&..'A.x(.l#.............*.|......3]......*..:&W..AG..L..&.Ep...1W........O.,@`.......9..vX.....t..{R.W9>....`.y..........C~."....=.7..#&`h..V.O...Z..Sv...SXs.D..].P...L..].w.4.:.......t(..T@.,...l%L......*...b.%8..Ze.T.U..X..,...\..9...a.\..{u..0....x.[gY......R.#...:.U`......."..yR..c..*H..q..0B...."O......*...q.L9....x....+..b...j.B;Cj.....I..@K.u....u.2.....a.@i..=.......N.....S...=...z..}v.....*@..P....S"...P.|........$..@;..1........&@C..*.......0r....p.3"u.+.!..Ur.....~.*+...YdW"C...-#"Z.....g...+.6)..3,.p.6.K6..5CA.qx!=[.-2...3..... T ..w.OY..t.`r.........m.....S^m...`....L..i.4.........l......G...F.%..I.5G....w...x.....o...v.....n.l./.(.........u.9V.....Q..Nu.@.i.......?.T..n.{.}..x..e..rGS.o..>RXL..f.3@.......u8....yGS.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\BBERG9W[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1622
                                                                                                                                                                                            Entropy (8bit):7.2063127622287535
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:U1hfvWwjx82lY2T3JVdpz4lpzayJ3VrpzB/pzfGtok3xWZezJLNKhhNXoYcrpbeT:aANn2NlzuzhJ3rzbzfPIxV5kh94eZfx/
                                                                                                                                                                                            MD5:7B1B36B2F81E70D9C22B34EA45D2579D
                                                                                                                                                                                            SHA1:E10ACB0952A31731F38D34AF1C02CD121784057B
                                                                                                                                                                                            SHA-256:A73D67096CCF12F95814A2D275D992A00DA57A4A5406A76BA09A453A8B42338E
                                                                                                                                                                                            SHA-512:CD23B852289F89729FB61FAE185E8CA26E86AAF128898FDD339EF6AF1AAD77A2D8EEEAA4B93C8A9687DBA73242A799601E6D2AD0C89E66C5C3F96ACFDAE42231
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2017 (Windows)" xmpMM:InstanceID="xmp.iid:D3DE4F21C79A11E7BCDCA837188533D6" xmpMM:DocumentID="xmp.did:D3DE4F22C79A11E7BCDCA837188533D6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3DE4F1FC79A11E7BCDCA837188533D6" stRef:documentID="xmp.did:D3DE4F20C79A11E7BCDCA837188533D6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.9.g....IDATx.lS]H.Q....]w.u.7..R. +.Q$..z._*.2..G)..|...%.0.%(L..'...D.!.(.P.Q..u.......;..&....;.|....|....j.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\RAJV3ZTJ.htm

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:HTML document, ASCII text, with very long lines (58200), with CRLF line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):191148
                                                                                                                                                                                            Entropy (8bit):5.462449735332645
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:nIIhqUwMa1ar2FtZmVL3GDoTt8GxHLiE25AglWG4g6U5NgW8uaw3duORA/FpNnDW:II0zNFD4LWDoRLk/h5NyhwNuORAK/xYU
                                                                                                                                                                                            MD5:E07CC25391190422085C633111A33C1C
                                                                                                                                                                                            SHA1:186E0316917FCE3FDE6EE2E841190CA8F1A0D931
                                                                                                                                                                                            SHA-256:F22F28B081963B05BE52E58E451CEEE2F40B8CFB7307B7FE6139FE1CD466F8E1
                                                                                                                                                                                            SHA-512:3216A877ED29C4FA7C13E158450C7D4BEB32D806D843789C209A167A0EAB1818850206EFC340B16B018553988B78FDAABB83819EE8B82EE9365B3E30A35895D8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-tat-msnvserp-t,1s-msntovserp,mms-sc-sc_con1,prg-c-visser,shp-xap-gr-ps,prg-sh-carrsb,prg-sh-enitlea,prg-sh-enitleactt,prg-sh-genreco,prg-sh-genrecocreative,prg-sh-genrecosubkeytest,shp-xap-gr-noux,prg-1sw-sa-qryannt2,prg-1sw-sa-ltmig0311t,prg-1sw-saql2restrictedt1,prg-1sw-sa-l2prerelvft4a,prg-1sw-p1size-inf-wm3,prg-1sw-infiriv,prg-1sw-p1size-inf,prg-1sw-p1sizeinc,prg-1sw-pagefilter,prg-1sw-rivactsec,cg-rr-ctr,1s-eaop1,prg-sh-badgewc,prg-fin-chl,btrecenus,iframeflex,prg-adspeek,1s-winauthservice,1s-ntf-hisenc,prg-1sw-samhibrnc0,prg-cg-uxprod,btie-fancy-img-t,prg-ad-ai-imgf,1s-fcrypt,1s-shp-xp-ectocnrich,prg-sh-ectocnrich,prg-premier-pr1-t1,1s-xapentprong1,prg-1sw-pro2pre,1s-p1-bnw6,prg-1sw-sa-bnw6,1s-ntf1-fyrvt2,1s-wpo-pr1-ifpsc-efy,prg-1sw-brnsspotbd,prg-1sw-fynp,prg-1sw-sa-fyrvt2,prg-1sw-ccl2-gbg2,prg-wpo-pnpc,1s-wpo-prg1-cnsimplify,1s-ntf2-fyrvt3,prg-1sw-sa-fyrvt1,prg-pr2-fy2tit,prg-

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\ie-image[1].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 1260 x 293, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):39155
                                                                                                                                                                                            Entropy (8bit):7.8985187905985486
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:c3+SnZXFurjYW0X0RJ/Dd18i72A/qcQ6Nj2CG+CiTZ2co4IXnmDt:DSnZXFuPSX0f837cQnCG+3WZXmx
                                                                                                                                                                                            MD5:E161E2045A32E4513E81954B1D83B953
                                                                                                                                                                                            SHA1:0A06306203C286B8C342CFD856C1EE3F16728C7E
                                                                                                                                                                                            SHA-256:7A344D69BC6657592E6041F0ED4F53F56ABA90B97EBD94559198B1D059DC7F64
                                                                                                                                                                                            SHA-512:7C7E5C2D2A0DF749BB4B52F2E8042829AE8ADD4F242674E13C14FEC436E56D7B173318D8408DD5A33462D38BC1FD2AD932B2060994B5A0C46F4B4BA89922437F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR.......%.....W.}^....pHYs.................sRGB.........gAMA......a.....IDATx.....diz..}.c._..W.7..Nc\..,@...]I w..")..DI+.!.6......A?2......pI`....{.........&.9...s2o...2Y5..0;.I{O..|.<.#...?. """""""".............&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\ie-image[2].png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:PNG image data, 1260 x 293, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):39155
                                                                                                                                                                                            Entropy (8bit):7.8985187905985486
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:c3+SnZXFurjYW0X0RJ/Dd18i72A/qcQ6Nj2CG+CiTZ2co4IXnmDt:DSnZXFuPSX0f837cQnCG+3WZXmx
                                                                                                                                                                                            MD5:E161E2045A32E4513E81954B1D83B953
                                                                                                                                                                                            SHA1:0A06306203C286B8C342CFD856C1EE3F16728C7E
                                                                                                                                                                                            SHA-256:7A344D69BC6657592E6041F0ED4F53F56ABA90B97EBD94559198B1D059DC7F64
                                                                                                                                                                                            SHA-512:7C7E5C2D2A0DF749BB4B52F2E8042829AE8ADD4F242674E13C14FEC436E56D7B173318D8408DD5A33462D38BC1FD2AD932B2060994B5A0C46F4B4BA89922437F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR.......%.....W.}^....pHYs.................sRGB.........gAMA......a.....IDATx.....diz..}.c._..W.7..Nc\..,@...]I w..")..DI+.!.6......A?2......pI`....{.........&.9...s2o...2Y5..0;.I{O..|.<.#...?. """""""".............&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\jquery-3.6.3.min[1].js

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:ASCII text, with very long lines (65447)
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):89947
                                                                                                                                                                                            Entropy (8bit):5.290839266829335
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:ENjxXU9rnxD9o5EZxkMVC6YLtg7HtDuU3zh8cmnPMEgWzJvBQUmkm4M5gPtcNRQK:EcqmCU3zhINzfmR4lb3e34UQ47GKL
                                                                                                                                                                                            MD5:CF2FBBF84281D9ECBFFB4993203D543B
                                                                                                                                                                                            SHA1:832A6A4E86DAF38B1975D705C5DE5D9E5F5844BC
                                                                                                                                                                                            SHA-256:A6F3F0FAEA4B3D48E03176341BEF0ED3151FFBF226D4C6635F1C6039C0500575
                                                                                                                                                                                            SHA-512:493A1FE319B5C2091F9BB85E5AA149567E7C1E6DC4B52DF55C569A81A6BC54C45E097024427259FA3132F0F082FE24F5F1D172F7959C131347153A8BCA9EF679
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:/*! jQuery v3.6.3 | (c) OpenJS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},S=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||S).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\me[1].json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):82675
                                                                                                                                                                                            Entropy (8bit):5.348750961143318
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:emHP59QZl9alUVv9WG4tcIoJOyagQJjWGH0h6owFbsstInOE5TXhgEoInMf/oNAf:emBONdc1IOzog0h+zZ
                                                                                                                                                                                            MD5:89037FB0C74BFCA22AED39878A69AD4A
                                                                                                                                                                                            SHA1:F5A3E04F29648DF2ACA5B7C4C2650394839E9C44
                                                                                                                                                                                            SHA-256:6A73849B519552DADF5CCFE0F9C2A35BB51B5AF0946046619A60727F60BC12D1
                                                                                                                                                                                            SHA-512:F78AEAE58C7054FAF7E2AA92254F52CC7D8D7DCC649D9C4665F43D6FB1A28AA6E8277134812598C26F67E00BAB1CA578EC68FCC7239019324E3AAE263F85E279
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"nextPageUrl":"https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=63ef3fec-aefa-487d-9714-65fe51d48535&$filter=_t eq 'CompositeCard'&contentType=article,video,slideshow,link,content360&infopaneCount=24&queryType=myfeed&location=47.7159|-122.204&ocid=msndl&apikey=Io4orNtwRr08vQQBER8stWzJbGltMJzMwkmiMOv9z3&activityId=7FF05383-E874-420B-A4A9-263700520B95&responseSchema=cardview&cm=en-us&timeOut=1000&WrapOData=false&DisableTypeSerialization=true","subCards":[{"type":"infopane","subCards":[{"id":"BB1jR89h","type":"article","title":"US House passes bill to force ByteDance to divest TikTok or face ban","abstract":"By David Shepardson WASHINGTON (Reuters) -The U.S. House of Representatives overwhelmingly passed a bill on Wednesday that would give TikTok's Chinese owner ByteDance about six months to divest the U.S. assets of the short-video app, or face a ban, in the greatest threat to the app since the Trump administration. The bill passed 352-65 in a bipartisan vote, but it faces

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\microsoft.afc9b4502f5cf6f88cca[1].js

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:ASCII text, with very long lines (65448)
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):94620
                                                                                                                                                                                            Entropy (8bit):5.4076498069548435
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:768:wYqLAnwLD2AFtbo2k3DG5wsxWkNcdJ/r3LLnt9+tISGtOMHiYnEvlwXLnt+79VlU:w7L37ivM1WkNWnt4KClwXLwsoxsE+
                                                                                                                                                                                            MD5:095130BBC3EEC571FCE0F8B59513E250
                                                                                                                                                                                            SHA1:391DFF8E9455FA291AF53500A60BC955B4E586A8
                                                                                                                                                                                            SHA-256:F834D3999811C38EACD96A27AFC0B913B38E84BB68D14D3F6DDF815C7D1ECB3D
                                                                                                                                                                                            SHA-512:35101C2CD26FFF76719977B4A99D769A0713B23BF874E43649F4EB6699E0A01BA74435A870C7C02B56DA1C928417B66EEE019B9B1ED3752F06C95CA8770D3E1F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:/*! For license information please see microsoft.afc9b4502f5cf6f88cca.js.LICENSE.txt */."use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences||[]).push([["microsoft"],{39115:function(n,e,t){t.d(e,{Z:function(){return M}});var r=t(68897),i=t(44611),o=t(89734),u=t(98693),a=t(38629),c=t(64648),f=t(73966),s=t(64973),l=t(26105),d=t(46540),v=500,p="Channel has invalid priority - ";function g(n,e,t){e&&(0,f.kJ)(e)&&e[c.R5]>0&&(e=e.sort((function(n,e){return n[s.yi]-e[s.yi]})),(0,f.tO)(e,(function(n){n[s.yi]<v&&(0,f._y)(p+n[c.pZ])})),n[c.MW]({queue:(0,f.FL)(e),chain:(0,l.jV)(e,t[c.TC],t)}))}var h=t(27218),m=t(24200),y=t(92687),S=t(28055),b=function(n){function e(){var t,r,a=n.call(this)||this;function l(){t=0,r=[]}return a.identifier="TelemetryInitializerPlugin",a.priority=199,l(),(0,i.Z)(e,a,(function(n,e){n.addTelemetryInitializer=function(n){var e={id:t++,fn:n};return r[c.MW](e),{remove:function(){(0,f.tO)(r,(function(n,t){if(n.id===e.id)retur

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\thQQ0VXPPK.jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):8559
                                                                                                                                                                                            Entropy (8bit):7.941113489530201
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:SjGTOWyYclRDVgHHGQn+ca69kVQ88Hf8jM0y8SJ69XKgwkCXxg:SjGwxNOmQn+MYl8HQM0yBEEO
                                                                                                                                                                                            MD5:16BC0C2B3EC93F960798FA97A68DDE28
                                                                                                                                                                                            SHA1:CE24AABD03CDFC665BFE871B02DF50190ACA32B7
                                                                                                                                                                                            SHA-256:89AF29B26FDCAA2BBD39C480B69C8CE71A71DD859F6BD64B670734CDFA668196
                                                                                                                                                                                            SHA-512:44D8B879818ADD8CE890D5D3D59CE7E2D7ADD85FA3878E4CCAADFFC3C446FD2893F2F35EFAF660B1C8EB7BC6CD16D40063A24FA232F63C72296F61CA6F58B3D9
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...~._.).f..H...1J.4...Z..9.)(..QE..(...."........c.I..;T|..GB.A.zt.QL.9..ZL.TR...A^.....m..^..............Rm <.U.A....s..A.FH...G..a].<3...Q[[If.L.c....z....X..3i...C.db.2.....>....b.....t.=.mI.=.P.....-..!..5......r."...tz_.u+I.;.ut...6X....V;.8N.bT.~D.r.{.$y=........b;TX.M...551.d....,.Nr>...r>(...l.d,.[.;.v....V....N{.#...g.4...Zs..5%H.JO,...8....(4.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\th[10].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):12300
                                                                                                                                                                                            Entropy (8bit):7.947747826951558
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SMAub54Y18pYv0YcIfmyrSJd9+Tz7F0CWqXycqxs:SZKDnyI+mSJmTzeUMs
                                                                                                                                                                                            MD5:CCB7509AF1030092F42A5D5F0BE0E1A3
                                                                                                                                                                                            SHA1:D495D5AAD6E2CB239853CCC95024425A63710E98
                                                                                                                                                                                            SHA-256:133DEEB576CA18E5CF42F2B90D4731E0B7CC5F2635EBF672AA3E4F8062221B30
                                                                                                                                                                                            SHA-512:2C70ECD809FC8C1A9F400C65D78EF14999DEB6F38A682F55625FB6272D649ECCAA2AE2868C83F7CD309AA361FC15F6F2D86B7D06F6FA124B3D824B9DADAC2A25
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..X...X.u.SXE{..3.Ev.S%...\..Q....O..1.~.'b.......<....y...C.......u.*Rw<.L...}.......U.../..U.'..T.'#....I.G.8...P.4.H.S......b.Ac....^H.$?J.5Y^58.v.P}..4)j)+......'.[...Wi.'n9......Gn}+G....~v!OrkX.0gi..X...h.m......5..^.6....Z<.g...0..NA*.,:...5....z............|....Vt_.<?.}B;;.....K....`1.@ m88.MzT'8E..N&0....:......T}X.....UD..r.Q.@..V...]

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\th[1].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):13991
                                                                                                                                                                                            Entropy (8bit):7.969986836963145
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:SKaD6XQ9QQCk62M8k9QFQnDVSX52TApqcNXNZYObwmPVl+5S7dktscarCWsT2u:SKaFQP52JQnJe2sq4QOMmtlEUPrCWU2u
                                                                                                                                                                                            MD5:62DFBC96CC1CBA78AFBDF2230CF3CF4E
                                                                                                                                                                                            SHA1:B111A9E6635BA17CF521BE9C4D74732D8C32148C
                                                                                                                                                                                            SHA-256:BBA2F4903F23F0785240C5969B9A076F39ADABB5416470FF3214F9A54E178F01
                                                                                                                                                                                            SHA-512:9AF762A2CFAA9F7B40D3B7D44FA1CE3E64CBA94372303756CF72242172FEBA8ACF4FF2A7AF22AC493BF8F0D58582874862541A47261D7A34755A2A4AC7711FB4
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........6os...).u..Q-.yg..P.F.&BX...I.....YN.b...@.9.......M.'..L0.b.....s.R...i..Q....nh..`n....[.(....u<k#/.g.K.J:._...52.....T..).'v*.L..c.....63.3...9.I".n.DVb^O.......w3...X...m.>...A."...@P.*..-<G.GlJ.T.h6..D....-.n..G5.%...;..X.V8.,}2O.?.A...$.M!..4.....?Z..5P...8.N.7v..x.}F.i..k)._..r_vz.c..s.....-&.nax.h`.1........gmL.(....N.w...-..-.+9.X.1w*....4.....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\th[2].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):18901
                                                                                                                                                                                            Entropy (8bit):7.962380111245422
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:S4zFBXYjLaZySXxlD6kzzlaaOydoPCxhBAi7XoWkbMJXbaM5xMW:S4JBojKlD6kQaJdoPCxhMWkwtBxT
                                                                                                                                                                                            MD5:D0587EF8A1728058EC445C357107AF29
                                                                                                                                                                                            SHA1:8145D50FA84BEDDA2CE740255C01FA923DF318F3
                                                                                                                                                                                            SHA-256:2F27DFB0221DD609AC55B33900944C7536D371B8A16D852D6CD3AAAD89A0AF9B
                                                                                                                                                                                            SHA-512:647AEE51DA540758EE9E79A9B54C1598D76F5BD52E2E93365AA5E1443058186FDE4D41A9DB69F53383BC0C5862C2FB2C902C050CC3425C8DE0D703B71E675BE4
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....i_r..&`..W5..di......nd.wM.....?.j;;t6..#..B....Ua..9-.".9......[Z.......+'Oym5$.;Lm.C.V...I".y$9.'....@<.../.g,R#..m....r9O.....i.h......b.@..?;:w..C..*.......c.j.....uEs..R....S*..J|.>C..U.cE...oRE.2..U/1e}.0....$...(..@.I....cf-..d...6..[..[..8........G.%.c...r..J....t.L..$M.......VEo0F...c..p.......Z..kb..w....c'xL.. .z.Z.........>..X..<..4

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\th[3].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):22781
                                                                                                                                                                                            Entropy (8bit):7.964812541106537
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SZBkYWHjvFkj3nfpSKfVMhFCjhawqURQux2CL3wYRmz+Yzh82:SZBR1jvpSKfVYFsAXURBnTwY4z+YzK2
                                                                                                                                                                                            MD5:306F73F00A4D2B1AE04F1A8BDF030852
                                                                                                                                                                                            SHA1:DDE00A9FA4B8CF20516D811781BB62ADBCDEC470
                                                                                                                                                                                            SHA-256:E40EE4C4260C5DA42381B4F58F8AF7897E4AE7853D85D9F711A913795E83A8D7
                                                                                                                                                                                            SHA-512:C0EF417A86E51AE84A47C55B476E557F8C190391DB6CFC9C17F4BD33F4DA956B1CA8BA2EE40F4434788EE4A5794003ABF493CB65F5FD52C1B729B6CD63FCEB80
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....q....4.a[.....r+..A.O.7../..R3.9..Pq........@.dQ.......m.k.....V{.u........4.......e.Gv|...<.......ei......7}....s.t.dT.o..wNyK..o....x6....~.w2/.$....v..u/c..3.....:D.2..0../...........+........o3...,W.V.. ....=..V8%.../.A..=.'.7.._......C. t5''...&}.T.s.S...A.<.4...z7..+.j..|..v..m..V......@9....+J.b.j..x.Y...'$.y._..H.y6+..om...._..'.*.c..c...5.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\th[4].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):13203
                                                                                                                                                                                            Entropy (8bit):7.9541793890886385
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SUd65jNtu0WEUeE8PDaggGRk5jx3deenE+Nn1udcF:Sa6lNtEMmORkpxttnhN11
                                                                                                                                                                                            MD5:60A31B3E1039664F471200681A3F1438
                                                                                                                                                                                            SHA1:B2E4EBACC53C530E107E0E49003F79CF90142038
                                                                                                                                                                                            SHA-256:AC9B148976499A54C85CBA4185A2F3002142F119EAEB7A6E87435FBD5F940E24
                                                                                                                                                                                            SHA-512:4E4FA6930CF0CB79643AA8633A17039837B4A6917DAF68531ADD42668B6D9A61F2CC385085D27A9442C1CF2C5B7C4092355AAFC7F668D3551D969ABEF88B66E5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?../....%...>].N+..........Nc.H......Z....h.......C.SJ....8}...l...%..Z.T..)..5 .9......."..I.D;.t....qF.U.....\).-*..(C...3.c......._.6...J.H.W....9.D....+..n.yz.m........$....7./..w...U.1*`0...........Z...q.o..O..T....'.l.l...:.=...R....[.X......7(X.p.T..L.=.......A.....(..%.u....*.G....N[..W]....k.6.i..j..NZVKx.N0.v.$...z..+_^jW;.m..;[v...OJ..ld.$.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\KO2EAB5M\th[9].jpg

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):20367
                                                                                                                                                                                            Entropy (8bit):7.959171958443
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:SSnn3yQPu+2I3f+nSbhEyS/Oo+Xr6gBsQKE4j176u7Y5LXyOMOasqRDi:SS3yQPjpf5bh4Wf4Qj4j17Jc5GO1as2+
                                                                                                                                                                                            MD5:6F31B49DD86651C7B3C600A7C96D0DD8
                                                                                                                                                                                            SHA1:32992C34B1567E45ED8A1E69A9CCCC3369B011CB
                                                                                                                                                                                            SHA-256:FB4260D91E4D6F4F428E55C783564A292C2444D66927B9F43792480514D79348
                                                                                                                                                                                            SHA-512:7A45010533644E6092BEBBCBBEF5772168C66FCB61A8D134593C780A925FA80EECEA9A3915A9EB99FE6FE0F627C2350653FD9FF9CA43D3A7E9D21D66A0074920
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...q.Q....GZ.3..M@.n..~.y..=..."..}*.1..$.a.MC3..I...H...9\}......[..<.sK...X...Q...A#.b.....(....6. .]J..y.....,q.V..".F..9..i.M..[...8...Q..j..T..k....E..Q..A...V4x.1..9....+....Q.,.,..9..*.Gl..b...K!.s..=..j.EE.;..9+.bQ"+...V.'h.tT68..5.k...y.(....5.c..se.......l.......g.PE&0....Go..Uh....6[.k.QZ".'...`|.$.(.s..lY|.[.z.k..*..n.f+............8.Q....d.&(

                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DAT

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):49120
                                                                                                                                                                                            Entropy (8bit):0.0017331682157558962
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:Ztt:T
                                                                                                                                                                                            MD5:0392ADA071EB68355BED625D8F9695F3
                                                                                                                                                                                            SHA1:777253141235B6C6AC92E17E297A1482E82252CC
                                                                                                                                                                                            SHA-256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
                                                                                                                                                                                            SHA-512:EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\04bab58c-c2f7-4996-ab00-f19e853a3cbe.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:very short file (no magic)
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1
                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:L:L
                                                                                                                                                                                            MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                            SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                            SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                            SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\6d3b6690-3d60-4da6-b918-59d8af6dc2ef.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:Google Chrome extension, version 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):11185
                                                                                                                                                                                            Entropy (8bit):7.951995436832936
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                                                                                                                            MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                                                                                                                            SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                                                                                                                            SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                                                                                                                            SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\7b9c0ead-9dfa-45c9-8b3b-9b349c881108.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:Google Chrome extension, version 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):98996
                                                                                                                                                                                            Entropy (8bit):7.702003651641397
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:+cQXinoKQoMGurcwFy3iTpv6zM39m3FPS:+cEUoKnfLvCCzM39m3FPS
                                                                                                                                                                                            MD5:34F93FE5B54D7C652360BA28D94F8E66
                                                                                                                                                                                            SHA1:31901469EADAD58B8BF99BBD9698E60ACDD7ABED
                                                                                                                                                                                            SHA-256:10DC1ED2D8D9D4DB369DDF7FD6F53EFFC9BFD87F46AFDFC6C86CB637D2067A38
                                                                                                                                                                                            SHA-512:9B86ACC2F5B92A75BD3028352F03DA10C6424C3514A3372A32EA8F60E79770D8B5AC5DBE0B45DD54B804C6EC79E1A1DBD887D0DF333DD253238DC30E6C5A1000
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:Cr24....f"........0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........;:[........o$..#Cb.G+.T.hI.9...M.J..u.:....13S..*...%...)Rd.rROmI#z_..sO6@...'/'..... \....5}k..R..2..22..?E.......r;E..Z...C.^.J...=.E.m..hb%{DiYnrD....T.....B.`Z..OCQf...."..P..7.W...D....}.E7P...uf........A.....s.L.!.......!.9..J..c\Ac\5.....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. Z.......o...$k.Sz.i...9D..K.$.. -=C.}.b...P....;.._"...u..s2#..c".>...........|[..:.._...9...O2o.A`.D......D....4..t...euGOL..~...:.:....^...?..C6...8.....?~..M............?..c#.R.........SyU.R..7..L...6r.mk.U.u....X..Wa.o...".o..l...(.5.....t..o......Y..1Q...me....K.....{.~N=8_.:."G.....qq5...^.~....s'.4...re.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\BIT544.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):124775448
                                                                                                                                                                                            Entropy (8bit):7.999996586829686
                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                            SSDEEP:3145728:G7pzQwa6D75W9AobFmNOlpCbLcRLq4vtpN8/RKA/gSBa5:GdzjD7s9FlgsRL9Vo/u5
                                                                                                                                                                                            MD5:40976C35E6CA27871F134A8A2FCAFC21
                                                                                                                                                                                            SHA1:FAA553B01EE47E9079F24A930BCE454BC2D48B37
                                                                                                                                                                                            SHA-256:F5E6C9BA8FB7867D041BC5D7591B50714688FBD31E6716A4D631D549ECEEB03C
                                                                                                                                                                                            SHA-512:4B178177039B894A92E712BFBE7358BB84F2830E8E042B77B3C1864A449F48FAADE7F5F016BC9C03B946BB47AF8389A3DE62C8CC283B9A948021E04338BEBDD6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...(..e.........."......8....o................@............................. p.......p...`..................................................Y..P........go...........o..(....p.(....X..............................PP..@...........0\...............................text...67.......8.................. ..`.rdata..`....P.......<..............@..@.data...p....p.......R..............@....pdata...............T..............@..@.retplne.............X...................rsrc....go......ho..Z..............@..@.reloc..(.....p.......o.............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\b3ce1ea1-4e8c-4a28-9a08-1f573f9c5271.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 118802
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):242356
                                                                                                                                                                                            Entropy (8bit):7.991210403664034
                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                            SSDEEP:6144:iRhzb6d0X7ayN8De2ei//LiBCNBs4vIVeJvx:iRFW0X2y0e2edcbveCp
                                                                                                                                                                                            MD5:D01AD4937EEB60A02BB525C82C8276BA
                                                                                                                                                                                            SHA1:1B3EB2D065E83849A22E751C40B2AA220C26C339
                                                                                                                                                                                            SHA-256:C59193D5128C21AED2F5311517F6C4DD0B4C1D14CB9B6E1F01F53DE57775F70C
                                                                                                                                                                                            SHA-512:DE981CDF56BC22D02DF548539EC3A411472B9D23DA960C466C6423A09F0559803088694B190DD0B4AE6432803A892F01ABFD438F68ED2E73AB5AC37314016574
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:...........}k{.F....W.<=)Y....[...&N.mn'N.M].?.4..P...|.........Pv.&..mwc..b0...`.e.[Y..........3~........>9.G.d>Ob......Y,..{xx....]......].r.{...3qsv.C.....o....A.J.......X.].v~|..t...0.].2..2.oO.O...a'.Y...ix..I.q..Ox.{+.c.JZ.'I..=..Ir..i..Xn......2:.N].._D.W.....Vw.jko.w.{w..}s[....F3P......&..9b.;....'.l.onz..d~...i...9O.......F..6N.ix...7..9..%w.....4..7..<.....O..J..O...N.../X.V.r........waH..... ...V.gy..y2m..........OS...(..$o..(j..q.dY+...T...r.Y.1.1..8.<...p$...E2.O.......~NC..c.@Nv.s....%...P..#p.....Cyl-........~......R.i....x....e..3.....@..x...:......nY....Z11>..S.~|7...K.....h..to..~Z..]Ly..Z......V#.L..E..I.x.K....Bho.z.x.E+....[....ZZ...*.>......0...w..o.?...=..../1.....p..w...2..E,H.$.0k..X.L9...X.....q.e......H....I......<.....=.. ..D<.................W.".........7S.!W.8...6|..0.....j....0.`....v...`<+.l*....._3.lh#.!..(t...}j.P.._...7'.......Q........F.u).@....~f.o...3x^y}.P..H......>mwEP....q....,Y.c..?....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\cv_debug.log

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):353
                                                                                                                                                                                            Entropy (8bit):5.347436838441579
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:YEhJB13X756s/uhJB13njmsPQJjDrwv/uhJB1/1Bn8eJ56s/C:YUP3L56s/aP3nS40Dkv/aP/PnPJ56s/C
                                                                                                                                                                                            MD5:368F1BC2FC4EC99B48C6C702471C7909
                                                                                                                                                                                            SHA1:B3BF678D1F417E7A8998EB8BEBF0E85445B741E7
                                                                                                                                                                                            SHA-256:08ADC650553A5120E75AFEBAF70451A10AB0329704BC2F8987CB6D8580AD3805
                                                                                                                                                                                            SHA-512:92B1279831739E2995E4D82EC1AD3C549CED151B83C07407954867A021D23EAF3096BBAE148FBF41F07EEF8AE1FE448918C50CC6C89F819F023442FB68ADF76D
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"logTime": "0314/081150", "correlationVector":"Z/IeLEmSszp8sI88hjrqZ9","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0314/081150", "correlationVector":"7C2E28F0CF814C8FAF7F8D77D8D62F32","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0314/081150", "correlationVector":"xpoDaRyUhYJDp8QyFEGYop","action":"EXTENSION_UPDATER", "result":""}.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\ef0f6224-549a-4b8c-bc08-415180af840e.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:very short file (no magic)
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1
                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:L:L
                                                                                                                                                                                            MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                            SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                            SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                            SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_262633448\6d3b6690-3d60-4da6-b918-59d8af6dc2ef.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:Google Chrome extension, version 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):11185
                                                                                                                                                                                            Entropy (8bit):7.951995436832936
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                                                                                                                            MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                                                                                                                            SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                                                                                                                            SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                                                                                                                            SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_262633448\CRX_INSTALL\_metadata\verified_contents.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1753
                                                                                                                                                                                            Entropy (8bit):5.8889033066924155
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
                                                                                                                                                                                            MD5:738E757B92939B24CDBBD0EFC2601315
                                                                                                                                                                                            SHA1:77058CBAFA625AAFBEA867052136C11AD3332143
                                                                                                                                                                                            SHA-256:D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
                                                                                                                                                                                            SHA-512:DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_262633448\CRX_INSTALL\content.js

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):9815
                                                                                                                                                                                            Entropy (8bit):6.1716321262973315
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
                                                                                                                                                                                            MD5:3D20584F7F6C8EAC79E17CCA4207FB79
                                                                                                                                                                                            SHA1:3C16DCC27AE52431C8CDD92FBAAB0341524D3092
                                                                                                                                                                                            SHA-256:0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
                                                                                                                                                                                            SHA-512:315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                            Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_262633448\CRX_INSTALL\content_new.js

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):10388
                                                                                                                                                                                            Entropy (8bit):6.174387413738973
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
                                                                                                                                                                                            MD5:3DE1E7D989C232FC1B58F4E32DE15D64
                                                                                                                                                                                            SHA1:42B152EA7E7F31A964914F344543B8BF14B5F558
                                                                                                                                                                                            SHA-256:D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
                                                                                                                                                                                            SHA-512:177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                            Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_262633448\CRX_INSTALL\manifest.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):962
                                                                                                                                                                                            Entropy (8bit):5.698567446030411
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
                                                                                                                                                                                            MD5:E805E9E69FD6ECDCA65136957B1FB3BE
                                                                                                                                                                                            SHA1:2356F60884130C86A45D4B232A26062C7830E622
                                                                                                                                                                                            SHA-256:5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
                                                                                                                                                                                            SHA-512:049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/*" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/*" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\7b9c0ead-9dfa-45c9-8b3b-9b349c881108.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:Google Chrome extension, version 3
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):98996
                                                                                                                                                                                            Entropy (8bit):7.702003651641397
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3072:+cQXinoKQoMGurcwFy3iTpv6zM39m3FPS:+cEUoKnfLvCCzM39m3FPS
                                                                                                                                                                                            MD5:34F93FE5B54D7C652360BA28D94F8E66
                                                                                                                                                                                            SHA1:31901469EADAD58B8BF99BBD9698E60ACDD7ABED
                                                                                                                                                                                            SHA-256:10DC1ED2D8D9D4DB369DDF7FD6F53EFFC9BFD87F46AFDFC6C86CB637D2067A38
                                                                                                                                                                                            SHA-512:9B86ACC2F5B92A75BD3028352F03DA10C6424C3514A3372A32EA8F60E79770D8B5AC5DBE0B45DD54B804C6EC79E1A1DBD887D0DF333DD253238DC30E6C5A1000
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:Cr24....f"........0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........;:[........o$..#Cb.G+.T.hI.9...M.J..u.:....13S..*...%...)Rd.rROmI#z_..sO6@...'/'..... \....5}k..R..2..22..?E.......r;E..Z...C.^.J...=.E.m..hb%{DiYnrD....T.....B.`Z..OCQf...."..P..7.W...D....}.E7P...uf........A.....s.L.!.......!.9..J..c\Ac\5.....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. Z.......o...$k.Sz.i...9D..K.$.. -=C.}.b...P....;.._"...u..s2#..c".>...........|[..:.._...9...O2o.A`.D......D....4..t...euGOL..~...:.:....^...?..C6...8.....?~..M............?..c#.R.........SyU.R..7..L...6r.mk.U.u....X..Wa.o...".o..l...(.5.....t..o......Y..1Q...me....K.....{.~N=8_.:."G.....qq5...^.~....s'.4...re.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\128.png

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):4982
                                                                                                                                                                                            Entropy (8bit):7.929761711048726
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
                                                                                                                                                                                            MD5:913064ADAAA4C4FA2A9D011B66B33183
                                                                                                                                                                                            SHA1:99EA751AC2597A080706C690612AEEEE43161FC1
                                                                                                                                                                                            SHA-256:AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
                                                                                                                                                                                            SHA-512:162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb*..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...*T.P.B...*Tx...=.Q..wv.w.....|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......|..}./.....e..,.K.1........W.u.v. ...\.o

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\af\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):908
                                                                                                                                                                                            Entropy (8bit):4.512512697156616
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
                                                                                                                                                                                            MD5:12403EBCCE3AE8287A9E823C0256D205
                                                                                                                                                                                            SHA1:C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
                                                                                                                                                                                            SHA-256:B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
                                                                                                                                                                                            SHA-512:153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\am\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1285
                                                                                                                                                                                            Entropy (8bit):4.702209356847184
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
                                                                                                                                                                                            MD5:9721EBCE89EC51EB2BAEB4159E2E4D8C
                                                                                                                                                                                            SHA1:58979859B28513608626B563138097DC19236F1F
                                                                                                                                                                                            SHA-256:3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
                                                                                                                                                                                            SHA-512:FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\ar\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1244
                                                                                                                                                                                            Entropy (8bit):4.5533961615623735
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
                                                                                                                                                                                            MD5:3EC93EA8F8422FDA079F8E5B3F386A73
                                                                                                                                                                                            SHA1:24640131CCFB21D9BC3373C0661DA02D50350C15
                                                                                                                                                                                            SHA-256:ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
                                                                                                                                                                                            SHA-512:F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\az\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):977
                                                                                                                                                                                            Entropy (8bit):4.867640976960053
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
                                                                                                                                                                                            MD5:9A798FD298008074E59ECC253E2F2933
                                                                                                                                                                                            SHA1:1E93DA985E880F3D3350FC94F5CCC498EFC8C813
                                                                                                                                                                                            SHA-256:628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
                                                                                                                                                                                            SHA-512:9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\be\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):3107
                                                                                                                                                                                            Entropy (8bit):3.535189746470889
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
                                                                                                                                                                                            MD5:68884DFDA320B85F9FC5244C2DD00568
                                                                                                                                                                                            SHA1:FD9C01E03320560CBBB91DC3D1917C96D792A549
                                                                                                                                                                                            SHA-256:DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
                                                                                                                                                                                            SHA-512:7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\bg\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1389
                                                                                                                                                                                            Entropy (8bit):4.561317517930672
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
                                                                                                                                                                                            MD5:2E6423F38E148AC5A5A041B1D5989CC0
                                                                                                                                                                                            SHA1:88966FFE39510C06CD9F710DFAC8545672FFDCEB
                                                                                                                                                                                            SHA-256:AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
                                                                                                                                                                                            SHA-512:891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\bn\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1763
                                                                                                                                                                                            Entropy (8bit):4.25392954144533
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
                                                                                                                                                                                            MD5:651375C6AF22E2BCD228347A45E3C2C9
                                                                                                                                                                                            SHA1:109AC3A912326171D77869854D7300385F6E628C
                                                                                                                                                                                            SHA-256:1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
                                                                                                                                                                                            SHA-512:958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\ca\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):930
                                                                                                                                                                                            Entropy (8bit):4.569672473374877
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
                                                                                                                                                                                            MD5:D177261FFE5F8AB4B3796D26835F8331
                                                                                                                                                                                            SHA1:4BE708E2FFE0F018AC183003B74353AD646C1657
                                                                                                                                                                                            SHA-256:D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
                                                                                                                                                                                            SHA-512:E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\cs\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):913
                                                                                                                                                                                            Entropy (8bit):4.947221919047
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
                                                                                                                                                                                            MD5:CCB00C63E4814F7C46B06E4A142F2DE9
                                                                                                                                                                                            SHA1:860936B2A500CE09498B07A457E0CCA6B69C5C23
                                                                                                                                                                                            SHA-256:21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
                                                                                                                                                                                            SHA-512:35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\cy\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):806
                                                                                                                                                                                            Entropy (8bit):4.815663786215102
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
                                                                                                                                                                                            MD5:A86407C6F20818972B80B9384ACFBBED
                                                                                                                                                                                            SHA1:D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
                                                                                                                                                                                            SHA-256:A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
                                                                                                                                                                                            SHA-512:D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\da\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):883
                                                                                                                                                                                            Entropy (8bit):4.5096240460083905
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
                                                                                                                                                                                            MD5:B922F7FD0E8CCAC31B411FC26542C5BA
                                                                                                                                                                                            SHA1:2D25E153983E311E44A3A348B7D97AF9AAD21A30
                                                                                                                                                                                            SHA-256:48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
                                                                                                                                                                                            SHA-512:AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\de\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1031
                                                                                                                                                                                            Entropy (8bit):4.621865814402898
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
                                                                                                                                                                                            MD5:D116453277CC860D196887CEC6432FFE
                                                                                                                                                                                            SHA1:0AE00288FDE696795CC62FD36EABC507AB6F4EA4
                                                                                                                                                                                            SHA-256:36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
                                                                                                                                                                                            SHA-512:C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\el\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1613
                                                                                                                                                                                            Entropy (8bit):4.618182455684241
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
                                                                                                                                                                                            MD5:9ABA4337C670C6349BA38FDDC27C2106
                                                                                                                                                                                            SHA1:1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
                                                                                                                                                                                            SHA-256:37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
                                                                                                                                                                                            SHA-512:8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\en\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):851
                                                                                                                                                                                            Entropy (8bit):4.4858053753176526
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                                                                                                                            MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                                                                                                                            SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                                                                                                                            SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                                                                                                                            SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\en_CA\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):851
                                                                                                                                                                                            Entropy (8bit):4.4858053753176526
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                                                                                                                            MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                                                                                                                            SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                                                                                                                            SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                                                                                                                            SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\en_GB\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):848
                                                                                                                                                                                            Entropy (8bit):4.494568170878587
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
                                                                                                                                                                                            MD5:3734D498FB377CF5E4E2508B8131C0FA
                                                                                                                                                                                            SHA1:AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
                                                                                                                                                                                            SHA-256:AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
                                                                                                                                                                                            SHA-512:56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\en_US\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1425
                                                                                                                                                                                            Entropy (8bit):4.461560329690825
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
                                                                                                                                                                                            MD5:578215FBB8C12CB7E6CD73FBD16EC994
                                                                                                                                                                                            SHA1:9471D71FA6D82CE1863B74E24237AD4FD9477187
                                                                                                                                                                                            SHA-256:102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
                                                                                                                                                                                            SHA-512:E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\es\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):961
                                                                                                                                                                                            Entropy (8bit):4.537633413451255
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
                                                                                                                                                                                            MD5:F61916A206AC0E971CDCB63B29E580E3
                                                                                                                                                                                            SHA1:994B8C985DC1E161655D6E553146FB84D0030619
                                                                                                                                                                                            SHA-256:2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
                                                                                                                                                                                            SHA-512:D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\es_419\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):959
                                                                                                                                                                                            Entropy (8bit):4.570019855018913
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
                                                                                                                                                                                            MD5:535331F8FB98894877811B14994FEA9D
                                                                                                                                                                                            SHA1:42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
                                                                                                                                                                                            SHA-256:90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
                                                                                                                                                                                            SHA-512:2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\et\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):968
                                                                                                                                                                                            Entropy (8bit):4.633956349931516
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
                                                                                                                                                                                            MD5:64204786E7A7C1ED9C241F1C59B81007
                                                                                                                                                                                            SHA1:586528E87CD670249A44FB9C54B1796E40CDB794
                                                                                                                                                                                            SHA-256:CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
                                                                                                                                                                                            SHA-512:44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\eu\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):838
                                                                                                                                                                                            Entropy (8bit):4.4975520913636595
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
                                                                                                                                                                                            MD5:29A1DA4ACB4C9D04F080BB101E204E93
                                                                                                                                                                                            SHA1:2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
                                                                                                                                                                                            SHA-256:A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
                                                                                                                                                                                            SHA-512:B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\fa\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1305
                                                                                                                                                                                            Entropy (8bit):4.673517697192589
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
                                                                                                                                                                                            MD5:097F3BA8DE41A0AAF436C783DCFE7EF3
                                                                                                                                                                                            SHA1:986B8CABD794E08C7AD41F0F35C93E4824AC84DF
                                                                                                                                                                                            SHA-256:7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
                                                                                                                                                                                            SHA-512:8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\fi\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):911
                                                                                                                                                                                            Entropy (8bit):4.6294343834070935
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
                                                                                                                                                                                            MD5:B38CBD6C2C5BFAA6EE252D573A0B12A1
                                                                                                                                                                                            SHA1:2E490D5A4942D2455C3E751F96BD9960F93C4B60
                                                                                                                                                                                            SHA-256:2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
                                                                                                                                                                                            SHA-512:6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\fil\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):939
                                                                                                                                                                                            Entropy (8bit):4.451724169062555
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
                                                                                                                                                                                            MD5:FCEA43D62605860FFF41BE26BAD80169
                                                                                                                                                                                            SHA1:F25C2CE893D65666CC46EA267E3D1AA080A25F5B
                                                                                                                                                                                            SHA-256:F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
                                                                                                                                                                                            SHA-512:F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\fr\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):977
                                                                                                                                                                                            Entropy (8bit):4.622066056638277
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
                                                                                                                                                                                            MD5:A58C0EEBD5DC6BB5D91DAF923BD3A2AA
                                                                                                                                                                                            SHA1:F169870EEED333363950D0BCD5A46D712231E2AE
                                                                                                                                                                                            SHA-256:0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
                                                                                                                                                                                            SHA-512:B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\fr_CA\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):972
                                                                                                                                                                                            Entropy (8bit):4.621319511196614
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
                                                                                                                                                                                            MD5:6CAC04BDCC09034981B4AB567B00C296
                                                                                                                                                                                            SHA1:84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
                                                                                                                                                                                            SHA-256:4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
                                                                                                                                                                                            SHA-512:160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\gl\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):990
                                                                                                                                                                                            Entropy (8bit):4.497202347098541
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
                                                                                                                                                                                            MD5:6BAAFEE2F718BEFBC7CD58A04CCC6C92
                                                                                                                                                                                            SHA1:CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
                                                                                                                                                                                            SHA-256:0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
                                                                                                                                                                                            SHA-512:3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\gu\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1658
                                                                                                                                                                                            Entropy (8bit):4.294833932445159
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
                                                                                                                                                                                            MD5:BC7E1D09028B085B74CB4E04D8A90814
                                                                                                                                                                                            SHA1:E28B2919F000B41B41209E56B7BF3A4448456CFE
                                                                                                                                                                                            SHA-256:FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
                                                                                                                                                                                            SHA-512:040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\hi\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1672
                                                                                                                                                                                            Entropy (8bit):4.314484457325167
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
                                                                                                                                                                                            MD5:98A7FC3E2E05AFFFC1CFE4A029F47476
                                                                                                                                                                                            SHA1:A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
                                                                                                                                                                                            SHA-256:D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
                                                                                                                                                                                            SHA-512:457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\hr\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):935
                                                                                                                                                                                            Entropy (8bit):4.6369398601609735
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
                                                                                                                                                                                            MD5:25CDFF9D60C5FC4740A48EF9804BF5C7
                                                                                                                                                                                            SHA1:4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
                                                                                                                                                                                            SHA-256:73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
                                                                                                                                                                                            SHA-512:EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\hu\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1065
                                                                                                                                                                                            Entropy (8bit):4.816501737523951
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
                                                                                                                                                                                            MD5:8930A51E3ACE3DD897C9E61A2AEA1D02
                                                                                                                                                                                            SHA1:4108506500C68C054BA03310C49FA5B8EE246EA4
                                                                                                                                                                                            SHA-256:958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
                                                                                                                                                                                            SHA-512:126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\hy\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2771
                                                                                                                                                                                            Entropy (8bit):3.7629875118570055
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
                                                                                                                                                                                            MD5:55DE859AD778E0AA9D950EF505B29DA9
                                                                                                                                                                                            SHA1:4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
                                                                                                                                                                                            SHA-256:0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
                                                                                                                                                                                            SHA-512:EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\id\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):858
                                                                                                                                                                                            Entropy (8bit):4.474411340525479
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
                                                                                                                                                                                            MD5:34D6EE258AF9429465AE6A078C2FB1F5
                                                                                                                                                                                            SHA1:612CAE151984449A4346A66C0A0DF4235D64D932
                                                                                                                                                                                            SHA-256:E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
                                                                                                                                                                                            SHA-512:20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\is\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):954
                                                                                                                                                                                            Entropy (8bit):4.631887382471946
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
                                                                                                                                                                                            MD5:1F565FB1C549B18AF8BBFED8DECD5D94
                                                                                                                                                                                            SHA1:B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
                                                                                                                                                                                            SHA-256:E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
                                                                                                                                                                                            SHA-512:A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\it\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):899
                                                                                                                                                                                            Entropy (8bit):4.474743599345443
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
                                                                                                                                                                                            MD5:0D82B734EF045D5FE7AA680B6A12E711
                                                                                                                                                                                            SHA1:BD04F181E4EE09F02CD53161DCABCEF902423092
                                                                                                                                                                                            SHA-256:F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
                                                                                                                                                                                            SHA-512:01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\iw\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2230
                                                                                                                                                                                            Entropy (8bit):3.8239097369647634
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
                                                                                                                                                                                            MD5:26B1533C0852EE4661EC1A27BD87D6BF
                                                                                                                                                                                            SHA1:18234E3ABAF702DF9330552780C2F33B83A1188A
                                                                                                                                                                                            SHA-256:BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
                                                                                                                                                                                            SHA-512:450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\ja\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1160
                                                                                                                                                                                            Entropy (8bit):5.292894989863142
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
                                                                                                                                                                                            MD5:15EC1963FC113D4AD6E7E59AE5DE7C0A
                                                                                                                                                                                            SHA1:4017FC6D8B302335469091B91D063B07C9E12109
                                                                                                                                                                                            SHA-256:34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
                                                                                                                                                                                            SHA-512:427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\ka\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):3264
                                                                                                                                                                                            Entropy (8bit):3.586016059431306
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
                                                                                                                                                                                            MD5:83F81D30913DC4344573D7A58BD20D85
                                                                                                                                                                                            SHA1:5AD0E91EA18045232A8F9DF1627007FE506A70E0
                                                                                                                                                                                            SHA-256:30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
                                                                                                                                                                                            SHA-512:85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\kk\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):3235
                                                                                                                                                                                            Entropy (8bit):3.6081439490236464
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
                                                                                                                                                                                            MD5:2D94A58795F7B1E6E43C9656A147AD3C
                                                                                                                                                                                            SHA1:E377DB505C6924B6BFC9D73DC7C02610062F674E
                                                                                                                                                                                            SHA-256:548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
                                                                                                                                                                                            SHA-512:F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\km\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):3122
                                                                                                                                                                                            Entropy (8bit):3.891443295908904
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
                                                                                                                                                                                            MD5:B3699C20A94776A5C2F90AEF6EB0DAD9
                                                                                                                                                                                            SHA1:1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
                                                                                                                                                                                            SHA-256:A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
                                                                                                                                                                                            SHA-512:1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\kn\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1880
                                                                                                                                                                                            Entropy (8bit):4.295185867329351
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
                                                                                                                                                                                            MD5:8E16966E815C3C274EEB8492B1EA6648
                                                                                                                                                                                            SHA1:7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
                                                                                                                                                                                            SHA-256:418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
                                                                                                                                                                                            SHA-512:85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\ko\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1042
                                                                                                                                                                                            Entropy (8bit):5.3945675025513955
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
                                                                                                                                                                                            MD5:F3E59EEEB007144EA26306C20E04C292
                                                                                                                                                                                            SHA1:83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
                                                                                                                                                                                            SHA-256:C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
                                                                                                                                                                                            SHA-512:7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\lo\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2535
                                                                                                                                                                                            Entropy (8bit):3.8479764584971368
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
                                                                                                                                                                                            MD5:E20D6C27840B406555E2F5091B118FC5
                                                                                                                                                                                            SHA1:0DCECC1A58CEB4936E255A64A2830956BFA6EC14
                                                                                                                                                                                            SHA-256:89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
                                                                                                                                                                                            SHA-512:AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\lt\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1028
                                                                                                                                                                                            Entropy (8bit):4.797571191712988
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
                                                                                                                                                                                            MD5:970544AB4622701FFDF66DC556847652
                                                                                                                                                                                            SHA1:14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
                                                                                                                                                                                            SHA-256:5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
                                                                                                                                                                                            SHA-512:CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\lv\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):994
                                                                                                                                                                                            Entropy (8bit):4.700308832360794
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
                                                                                                                                                                                            MD5:A568A58817375590007D1B8ABCAEBF82
                                                                                                                                                                                            SHA1:B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
                                                                                                                                                                                            SHA-256:0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
                                                                                                                                                                                            SHA-512:FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\ml\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2091
                                                                                                                                                                                            Entropy (8bit):4.358252286391144
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
                                                                                                                                                                                            MD5:4717EFE4651F94EFF6ACB6653E868D1A
                                                                                                                                                                                            SHA1:B8A7703152767FBE1819808876D09D9CC1C44450
                                                                                                                                                                                            SHA-256:22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
                                                                                                                                                                                            SHA-512:487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\mn\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2778
                                                                                                                                                                                            Entropy (8bit):3.595196082412897
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
                                                                                                                                                                                            MD5:83E7A14B7FC60D4C66BF313C8A2BEF0B
                                                                                                                                                                                            SHA1:1CCF1D79CDED5D65439266DB58480089CC110B18
                                                                                                                                                                                            SHA-256:613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
                                                                                                                                                                                            SHA-512:3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\mr\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1719
                                                                                                                                                                                            Entropy (8bit):4.287702203591075
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
                                                                                                                                                                                            MD5:3B98C4ED8874A160C3789FEAD5553CFA
                                                                                                                                                                                            SHA1:5550D0EC548335293D962AAA96B6443DD8ABB9F6
                                                                                                                                                                                            SHA-256:ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
                                                                                                                                                                                            SHA-512:5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\ms\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):936
                                                                                                                                                                                            Entropy (8bit):4.457879437756106
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
                                                                                                                                                                                            MD5:7D273824B1E22426C033FF5D8D7162B7
                                                                                                                                                                                            SHA1:EADBE9DBE5519BD60458B3551BDFC36A10049DD1
                                                                                                                                                                                            SHA-256:2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
                                                                                                                                                                                            SHA-512:E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\my\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):3830
                                                                                                                                                                                            Entropy (8bit):3.5483353063347587
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
                                                                                                                                                                                            MD5:342335A22F1886B8BC92008597326B24
                                                                                                                                                                                            SHA1:2CB04F892E430DCD7705C02BF0A8619354515513
                                                                                                                                                                                            SHA-256:243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
                                                                                                                                                                                            SHA-512:CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\ne\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1898
                                                                                                                                                                                            Entropy (8bit):4.187050294267571
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
                                                                                                                                                                                            MD5:B1083DA5EC718D1F2F093BD3D1FB4F37
                                                                                                                                                                                            SHA1:74B6F050D918448396642765DEF1AD5390AB5282
                                                                                                                                                                                            SHA-256:E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
                                                                                                                                                                                            SHA-512:7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\nl\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):914
                                                                                                                                                                                            Entropy (8bit):4.513485418448461
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
                                                                                                                                                                                            MD5:32DF72F14BE59A9BC9777113A8B21DE6
                                                                                                                                                                                            SHA1:2A8D9B9A998453144307DD0B700A76E783062AD0
                                                                                                                                                                                            SHA-256:F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
                                                                                                                                                                                            SHA-512:E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\no\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):878
                                                                                                                                                                                            Entropy (8bit):4.4541485835627475
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
                                                                                                                                                                                            MD5:A1744B0F53CCF889955B95108367F9C8
                                                                                                                                                                                            SHA1:6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
                                                                                                                                                                                            SHA-256:21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
                                                                                                                                                                                            SHA-512:F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\pa\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2766
                                                                                                                                                                                            Entropy (8bit):3.839730779948262
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
                                                                                                                                                                                            MD5:97F769F51B83D35C260D1F8CFD7990AF
                                                                                                                                                                                            SHA1:0D59A76564B0AEE31D0A074305905472F740CECA
                                                                                                                                                                                            SHA-256:BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
                                                                                                                                                                                            SHA-512:D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\pl\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):978
                                                                                                                                                                                            Entropy (8bit):4.879137540019932
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
                                                                                                                                                                                            MD5:B8D55E4E3B9619784AECA61BA15C9C0F
                                                                                                                                                                                            SHA1:B4A9C9885FBEB78635957296FDDD12579FEFA033
                                                                                                                                                                                            SHA-256:E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
                                                                                                                                                                                            SHA-512:266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\pt_BR\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):907
                                                                                                                                                                                            Entropy (8bit):4.599411354657937
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
                                                                                                                                                                                            MD5:608551F7026E6BA8C0CF85D9AC11F8E3
                                                                                                                                                                                            SHA1:87B017B2D4DA17E322AF6384F82B57B807628617
                                                                                                                                                                                            SHA-256:A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
                                                                                                                                                                                            SHA-512:82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\pt_PT\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):914
                                                                                                                                                                                            Entropy (8bit):4.604761241355716
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
                                                                                                                                                                                            MD5:0963F2F3641A62A78B02825F6FA3941C
                                                                                                                                                                                            SHA1:7E6972BEAB3D18E49857079A24FB9336BC4D2D48
                                                                                                                                                                                            SHA-256:E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
                                                                                                                                                                                            SHA-512:22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\ro\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):937
                                                                                                                                                                                            Entropy (8bit):4.686555713975264
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
                                                                                                                                                                                            MD5:BED8332AB788098D276B448EC2B33351
                                                                                                                                                                                            SHA1:6084124A2B32F386967DA980CBE79DD86742859E
                                                                                                                                                                                            SHA-256:085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
                                                                                                                                                                                            SHA-512:22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\ru\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1337
                                                                                                                                                                                            Entropy (8bit):4.69531415794894
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
                                                                                                                                                                                            MD5:51D34FE303D0C90EE409A2397FCA437D
                                                                                                                                                                                            SHA1:B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
                                                                                                                                                                                            SHA-256:BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
                                                                                                                                                                                            SHA-512:E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\si\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2846
                                                                                                                                                                                            Entropy (8bit):3.7416822879702547
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
                                                                                                                                                                                            MD5:B8A4FD612534A171A9A03C1984BB4BDD
                                                                                                                                                                                            SHA1:F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
                                                                                                                                                                                            SHA-256:54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
                                                                                                                                                                                            SHA-512:C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\sk\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):934
                                                                                                                                                                                            Entropy (8bit):4.882122893545996
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
                                                                                                                                                                                            MD5:8E55817BF7A87052F11FE554A61C52D5
                                                                                                                                                                                            SHA1:9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
                                                                                                                                                                                            SHA-256:903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
                                                                                                                                                                                            SHA-512:EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\sl\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):963
                                                                                                                                                                                            Entropy (8bit):4.6041913416245
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
                                                                                                                                                                                            MD5:BFAEFEFF32813DF91C56B71B79EC2AF4
                                                                                                                                                                                            SHA1:F8EDA2B632610972B581724D6B2F9782AC37377B
                                                                                                                                                                                            SHA-256:AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
                                                                                                                                                                                            SHA-512:971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\sr\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1320
                                                                                                                                                                                            Entropy (8bit):4.569671329405572
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
                                                                                                                                                                                            MD5:7F5F8933D2D078618496C67526A2B066
                                                                                                                                                                                            SHA1:B7050E3EFA4D39548577CF47CB119FA0E246B7A4
                                                                                                                                                                                            SHA-256:4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
                                                                                                                                                                                            SHA-512:0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\sv\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):884
                                                                                                                                                                                            Entropy (8bit):4.627108704340797
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
                                                                                                                                                                                            MD5:90D8FB448CE9C0B9BA3D07FB8DE6D7EE
                                                                                                                                                                                            SHA1:D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
                                                                                                                                                                                            SHA-256:64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
                                                                                                                                                                                            SHA-512:6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\sw\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):980
                                                                                                                                                                                            Entropy (8bit):4.50673686618174
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
                                                                                                                                                                                            MD5:D0579209686889E079D87C23817EDDD5
                                                                                                                                                                                            SHA1:C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
                                                                                                                                                                                            SHA-256:0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
                                                                                                                                                                                            SHA-512:D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\ta\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1941
                                                                                                                                                                                            Entropy (8bit):4.132139619026436
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
                                                                                                                                                                                            MD5:DCC0D1725AEAEAAF1690EF8053529601
                                                                                                                                                                                            SHA1:BB9D31859469760AC93E84B70B57909DCC02EA65
                                                                                                                                                                                            SHA-256:6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
                                                                                                                                                                                            SHA-512:6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\te\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1969
                                                                                                                                                                                            Entropy (8bit):4.327258153043599
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
                                                                                                                                                                                            MD5:385E65EF723F1C4018EEE6E4E56BC03F
                                                                                                                                                                                            SHA1:0CEA195638A403FD99BAEF88A360BD746C21DF42
                                                                                                                                                                                            SHA-256:026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
                                                                                                                                                                                            SHA-512:E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\th\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1674
                                                                                                                                                                                            Entropy (8bit):4.343724179386811
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
                                                                                                                                                                                            MD5:64077E3D186E585A8BEA86FF415AA19D
                                                                                                                                                                                            SHA1:73A861AC810DABB4CE63AD052E6E1834F8CA0E65
                                                                                                                                                                                            SHA-256:D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
                                                                                                                                                                                            SHA-512:56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\tr\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1063
                                                                                                                                                                                            Entropy (8bit):4.853399816115876
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
                                                                                                                                                                                            MD5:76B59AAACC7B469792694CF3855D3F4C
                                                                                                                                                                                            SHA1:7C04A2C1C808FA57057A4CCEEE66855251A3C231
                                                                                                                                                                                            SHA-256:B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
                                                                                                                                                                                            SHA-512:2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\uk\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1333
                                                                                                                                                                                            Entropy (8bit):4.686760246306605
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
                                                                                                                                                                                            MD5:970963C25C2CEF16BB6F60952E103105
                                                                                                                                                                                            SHA1:BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
                                                                                                                                                                                            SHA-256:9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
                                                                                                                                                                                            SHA-512:1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\ur\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1263
                                                                                                                                                                                            Entropy (8bit):4.861856182762435
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
                                                                                                                                                                                            MD5:8B4DF6A9281333341C939C244DDB7648
                                                                                                                                                                                            SHA1:382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
                                                                                                                                                                                            SHA-256:5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
                                                                                                                                                                                            SHA-512:FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\vi\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1074
                                                                                                                                                                                            Entropy (8bit):5.062722522759407
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
                                                                                                                                                                                            MD5:773A3B9E708D052D6CBAA6D55C8A5438
                                                                                                                                                                                            SHA1:5617235844595D5C73961A2C0A4AC66D8EA5F90F
                                                                                                                                                                                            SHA-256:597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
                                                                                                                                                                                            SHA-512:E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\zh_CN\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):879
                                                                                                                                                                                            Entropy (8bit):5.7905809868505544
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
                                                                                                                                                                                            MD5:3E76788E17E62FB49FB5ED5F4E7A3DCE
                                                                                                                                                                                            SHA1:6904FFA0D13D45496F126E58C886C35366EFCC11
                                                                                                                                                                                            SHA-256:E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
                                                                                                                                                                                            SHA-512:F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\zh_HK\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):1205
                                                                                                                                                                                            Entropy (8bit):4.50367724745418
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
                                                                                                                                                                                            MD5:524E1B2A370D0E71342D05DDE3D3E774
                                                                                                                                                                                            SHA1:60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
                                                                                                                                                                                            SHA-256:30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
                                                                                                                                                                                            SHA-512:D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\zh_TW\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):843
                                                                                                                                                                                            Entropy (8bit):5.76581227215314
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
                                                                                                                                                                                            MD5:0E60627ACFD18F44D4DF469D8DCE6D30
                                                                                                                                                                                            SHA1:2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
                                                                                                                                                                                            SHA-256:F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
                                                                                                                                                                                            SHA-512:6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_locales\zu\messages.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):912
                                                                                                                                                                                            Entropy (8bit):4.65963951143349
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
                                                                                                                                                                                            MD5:71F916A64F98B6D1B5D1F62D297FDEC1
                                                                                                                                                                                            SHA1:9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
                                                                                                                                                                                            SHA-256:EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
                                                                                                                                                                                            SHA-512:30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\_metadata\verified_contents.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):18518
                                                                                                                                                                                            Entropy (8bit):5.709939179890619
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:384:cLjrY6QDAwrlbs3jiD1DisLSFqwAqmq9ayzDy:2jrSHbMjidLSFxA+ayfy
                                                                                                                                                                                            MD5:05BEDDE10A35815204BEB8BADD3DB9B4
                                                                                                                                                                                            SHA1:000E7E6984EDEF11E937929DB047FF6FCB87CB1E
                                                                                                                                                                                            SHA-256:65A138E44834C8EE9D2946960C97D6FF3978874F4641A16568322B9318976151
                                                                                                                                                                                            SHA-512:9F42514DBA8F11ED41041C68960B7538BADFC0CEC6AF01F885AB7197DA27CAE0EC0DE78E49D585612AC4B5C025C070EF4F03ED39E894D9699FFE887272487D07
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiOE1xa2JXMkFQWkVpbzlQTHlYNVItT3o1bGs5a29sbnlWTWtvYlVabk15YyIsInBhdGgiOiJfbG9jYWxlcy9hZi9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoicWhJZ1d4Q0hVTS1mb0plRVlhYllpQjVPZ05vZ3FFYllKTnBBYWRuSkdFYyJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiV0E0cW96b3R5ZzJrcUpKU0FEYWNVMGNDbEdJYjlmMmp1ejhYalh0YUhybyIsInBhdGgiOiJfbG9jYWxlcy9hbS9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiWk9BYndwSzZMcUZwbFhiOHhFVTJjRWRTRHVpVjRwRE03aURDVEpNMjJPOCJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiQlk4QVRlUUktWHNqLWFSbVZfTi03dHVzUlJyQUNkU25yU3NhT2d3R3pTWSIsInBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiX0pLU3pRcGk4TVczZE5WZldwN281STVjX09

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\dasherSettingSchema.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):854
                                                                                                                                                                                            Entropy (8bit):4.284628987131403
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
                                                                                                                                                                                            MD5:4EC1DF2DA46182103D2FFC3B92D20CA5
                                                                                                                                                                                            SHA1:FB9D1BA3710CF31A87165317C6EDC110E98994CE
                                                                                                                                                                                            SHA-256:6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
                                                                                                                                                                                            SHA-512:939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\eventpage_bin_prod.js

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text, with very long lines (3422)
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):82471
                                                                                                                                                                                            Entropy (8bit):5.379624543852408
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:1536:1jejtmkYJ6fA5z4d+3+NOzChedbeZtk68cWcYuCKRLlGGwL:BvuTczCQbIZBY7L
                                                                                                                                                                                            MD5:A7D0D56DF8E576C9CDE7DB6C11045CD7
                                                                                                                                                                                            SHA1:EAFE0A7FE5217B254FCE57223A5C8F4A30B1B56A
                                                                                                                                                                                            SHA-256:37FABD0B7AB065ECAF481064D770A2DBF61A8C23F6BE1E10D2085812ADB0EC8A
                                                                                                                                                                                            SHA-512:66ACA2AA2BC4DB901250DA2DAD0202352D89CD8C1A16616F106FF73D0EED2E1EC4852940443BAFDFAAB264AF1185769B33E240BB94E8B263AA5B0D6AF16CFB10
                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                            Preview:'use strict';function m(){return function(){}}var p;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ca(this);function t(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,g){this.g=f;ba(this,"description",{configurable:!

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\manifest.json

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):2397
                                                                                                                                                                                            Entropy (8bit):5.424093225335539
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:24:1HEZ4qW4VlELb/KxktGu7VwELb/s2QDkUpvdlmF1exy/Otj1pSVvs:W7WsaLTKQGuxTLT2Rv3mves/OPpSVk
                                                                                                                                                                                            MD5:A71CE16FE7E71948777A01794E461DE4
                                                                                                                                                                                            SHA1:51310DF56DBDEC1329DB8946888A208B477712CA
                                                                                                                                                                                            SHA-256:431EBF00F6BAB228FBAD80663CAAE73427516D6AB3D34939ECB6DCB5D0A566CC
                                                                                                                                                                                            SHA-512:EAA2513BCA54F184083CD6E50738EF99D8C5C562075D5237E5B5A23DDA8DA694A7B0F0E9251C7C9A3BE2BD51614CCEBF32127F4CC9C49DDA9A7036434E7D5AAB
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "persistent": false,.. "scripts": [ "eventpage_bin_prod.js" ].. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/*", "https://drive.google.com/*", "https://drive-autopush.corp.google.com/*", "https://drive-daily-0.corp.google.com/*", "https://drive-daily-1.corp.google.com/*", "https://drive-daily-2.corp.google.com/*", "https://drive-daily-3.corp.google.com/*", "https://drive-daily-4.corp.google.com/*", "https://drive-daily-5.corp.google.com/*", "https://drive-daily-6.corp.google.com/*", "https://drive-preprod.corp.google.com/*", "https://drive-staging.corp.google.com/*" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": "script-src 'self'; object-src 'self'",.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "matches": [ "htt

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\scoped_dir7288_914051638\CRX_INSTALL\page_embed_script.js

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):291
                                                                                                                                                                                            Entropy (8bit):4.644891151983713
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK6M23:2Q8KVqb2u/Rt3OnjI
                                                                                                                                                                                            MD5:EE9839F99DED6F38DC561DB846B51E80
                                                                                                                                                                                            SHA1:DD2128A473C2FF47471400C81EFF416285DE606E
                                                                                                                                                                                            SHA-256:06E08E421EB7F0FE7959D68E27D40A9146A54503090D95CFAC6F2FFD72A78769
                                                                                                                                                                                            SHA-512:C8D77607F00CB8012CD056CE61CB77918EC43621270511303E09577F89CC57D4954E22E2C8C3FB1029AAE29F8142DAAE2E938CD5590AD0E5DE6DB1208AFEF874
                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                            Preview:(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=2;}).call(this);.

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\{EA1E0980-B396-4668-911E-C8E8FC8F4896}-brave_installer-x64.exe (copy)

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):124775448
                                                                                                                                                                                            Entropy (8bit):7.999996586829686
                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                            SSDEEP:3145728:G7pzQwa6D75W9AobFmNOlpCbLcRLq4vtpN8/RKA/gSBa5:GdzjD7s9FlgsRL9Vo/u5
                                                                                                                                                                                            MD5:40976C35E6CA27871F134A8A2FCAFC21
                                                                                                                                                                                            SHA1:FAA553B01EE47E9079F24A930BCE454BC2D48B37
                                                                                                                                                                                            SHA-256:F5E6C9BA8FB7867D041BC5D7591B50714688FBD31E6716A4D631D549ECEEB03C
                                                                                                                                                                                            SHA-512:4B178177039B894A92E712BFBE7358BB84F2830E8E042B77B3C1864A449F48FAADE7F5F016BC9C03B946BB47AF8389A3DE62C8CC283B9A948021E04338BEBDD6
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...(..e.........."......8....o................@............................. p.......p...`..................................................Y..P........go...........o..(....p.(....X..............................PP..@...........0\...............................text...67.......8.................. ..`.rdata..`....P.......<..............@..@.data...p....p.......R..............@....pdata...............T..............@..@.retplne.............X...................rsrc....go......ho..Z..............@..@.reloc..(.....p.......o.............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\~DF13BBA3D480F39C72.TMP

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                            Entropy (8bit):0.2364979660455589
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN2cgJ8H1C:9vqyVKvqy6yEyvy5DlsN5Ac
                                                                                                                                                                                            MD5:7DA63F3349ADCE46708E4C0690063EC5
                                                                                                                                                                                            SHA1:3A4B1BC2A9F48A8E4227E461B85B46F14CA69D3D
                                                                                                                                                                                            SHA-256:C40819535B4185A8DB93B768A6B27657C5234D9789992D278CC01A4B3E353775
                                                                                                                                                                                            SHA-512:20C16F35AFA9B663C268224BE0AC6CFCAD7F5EDD2F3903E50BA5803ECC421BF54ED974001D3F056CA8E830832C874BA53AD30B111000ECBA361B9DF18BE2265F
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\~DF4C6492E935F128AD.TMP

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                            Entropy (8bit):0.2364979660455589
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN16gJ8H1C:9vqyVKvqy6yEyvy5DlsNUAc
                                                                                                                                                                                            MD5:766DC8C2D2B704377A5D7A7CF489F4B1
                                                                                                                                                                                            SHA1:DD1B20EA878BAC7D8AEB1A77C3EEE35429A069BE
                                                                                                                                                                                            SHA-256:56669F04C60CBD07A2EE32D7B66236E4DE354EE94A1C34BAF25B6B3ED203E159
                                                                                                                                                                                            SHA-512:59EAE579720FCD522F65D796101FD2B16EE20DD5D9812386436345BFE009961C3A6785F994E85AAFAEDC9F198E58BC671D367377550604CD99CF76EB88211E94
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\~DF6553D8487F5B6685.TMP

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                            Entropy (8bit):0.47147237799647335
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN16gJ8H1CcWpDWN+od:9vqyVKvqy6yEyvy5DlsNUAckDWN+od
                                                                                                                                                                                            MD5:094523449716CA11E129B7BA843F4CD3
                                                                                                                                                                                            SHA1:40BAA043887453FAFBF8742018D2D6465F126867
                                                                                                                                                                                            SHA-256:1D473D238A1774BD3A73EE2F4813A207F08CF732FE9E09CB9E63C7840B656535
                                                                                                                                                                                            SHA-512:9CDA2D0CB3B203AA488388DA5A4BFC91D4178A75418D0C16090863CE3A3FA4F45A9BE02AE3F5949F45595F6A140AA29D18AE3B4EC5BE250E6EF0C097161A5A72
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\~DF75BDE9CDAC2BBDD9.TMP

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                            Entropy (8bit):0.223854940729273
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:6:/lwC2ilzAR20lQ0a/i0lQAYISF1KqF1MC8jlOLIflX:GN2ktcSFgShEf1
                                                                                                                                                                                            MD5:403F13C7C7459909EF17DE4487A0FA46
                                                                                                                                                                                            SHA1:BA846FCD91F518843ED6464C1C2DD9396A4053B8
                                                                                                                                                                                            SHA-256:5B313584882295C8F17D296622134669307E49A092F2B3C878000CF50D519B53
                                                                                                                                                                                            SHA-512:2996D6DCD821F156930B2F674EEC92F94BE7F6501AC132533E152DFB489CD5538764481E47D17FBD35028BED1181E76CA56E4A1CDE5988CEFB7F4FD971CB5D61
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\~DF9AF92C7928DA52EC.TMP

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                            Entropy (8bit):1.3777859945833824
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:ls9JvyNLLN+N8/VeoFBiSLZLDA9PLJLRYJ:lpZCo12L1RY
                                                                                                                                                                                            MD5:D33F885349FB87B7B813698B29EBB2A7
                                                                                                                                                                                            SHA1:976A9062A332801BDA02B1A3BBC904C679FC15B7
                                                                                                                                                                                            SHA-256:5D879F75DF8E6B51D925C5FF5206FAC211B38B8528B9A08A248ECFF0708DE741
                                                                                                                                                                                            SHA-512:FE36762FF81542AFB03AE058329DE1942054D60D2C21DDAE4857592B2E0BE40A26F71F754BF05188A8B0222D04C13CF5015E0267900DAB307B4A8A54B9554070
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\~DF9F37323B872DE1AA.TMP

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                            Entropy (8bit):1.238604111696572
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:48:9SgKS9LYu09eEgv7q1KuZtXBGHHcAZ6Sq6Egv7q1KuZtEKuZt:ls9HY9ujX88BY9ujDuj
                                                                                                                                                                                            MD5:F7F6E7EA8414500927EE141B04579ACE
                                                                                                                                                                                            SHA1:9E9A788295BF807B017B95BE2E79ED21773D4125
                                                                                                                                                                                            SHA-256:E0F1D4CD3F18D7A494BF0CD8CF88241B2E3E0F12BC5DBC8214991E65584A7883
                                                                                                                                                                                            SHA-512:BC1FCDD3EF51F7C4942C0E4CF3900EBF37BEC4259577A5FFFDDC778C47F5FF612148D017CF3429D20219F2B25E9645D7815AC91D1C3DF76C885F8744D8665B64
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\~DFA49F759DD72EB437.TMP

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                            Entropy (8bit):0.2364979660455589
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN16gJ8H1C:9vqyVKvqy6yEyvy5DlsNUAc
                                                                                                                                                                                            MD5:766DC8C2D2B704377A5D7A7CF489F4B1
                                                                                                                                                                                            SHA1:DD1B20EA878BAC7D8AEB1A77C3EEE35429A069BE
                                                                                                                                                                                            SHA-256:56669F04C60CBD07A2EE32D7B66236E4DE354EE94A1C34BAF25B6B3ED203E159
                                                                                                                                                                                            SHA-512:59EAE579720FCD522F65D796101FD2B16EE20DD5D9812386436345BFE009961C3A6785F994E85AAFAEDC9F198E58BC671D367377550604CD99CF76EB88211E94
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\~DFBAD3EB6D48745B26.TMP

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            File Type:data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                            Entropy (8bit):0.2364979660455589
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN16gJ8H1C:9vqyVKvqy6yEyvy5DlsNUAc
                                                                                                                                                                                            MD5:766DC8C2D2B704377A5D7A7CF489F4B1
                                                                                                                                                                                            SHA1:DD1B20EA878BAC7D8AEB1A77C3EEE35429A069BE
                                                                                                                                                                                            SHA-256:56669F04C60CBD07A2EE32D7B66236E4DE354EE94A1C34BAF25B6B3ED203E159
                                                                                                                                                                                            SHA-512:59EAE579720FCD522F65D796101FD2B16EE20DD5D9812386436345BFE009961C3A6785F994E85AAFAEDC9F198E58BC671D367377550604CD99CF76EB88211E94
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                            C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):55
                                                                                                                                                                                            Entropy (8bit):4.306461250274409
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                                            MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                                            SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                                            SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                                            SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                                                            C:\Windows\Temp\gui4A8.tmp

                                                                                                                                                                                            Download File
                                                                                                                                                                                            Process:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (4404), with no line terminators
                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                            Size (bytes):4407
                                                                                                                                                                                            Entropy (8bit):6.01624901027111
                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                            SSDEEP:96:7wcN5LCsQ3+qLjHt1bMCmC8YMcwAqi+FY2pZqiUkWIk0AwWAJGOE1:J6+qXHt1QCmUMcwTiWY2hUkyrwWAc
                                                                                                                                                                                            MD5:DA89A2F9314528D7D6A27CC4DF5965E4
                                                                                                                                                                                            SHA1:3242EE1187E7ECF79ABC052ED6725FC070E6423C
                                                                                                                                                                                            SHA-256:CFF0E6414634580AF01999F04356F14285CD48BC004D741DE6615B93E20EC4F0
                                                                                                                                                                                            SHA-512:B6584795A15D3EF45BC1EDC0DE4E59633A7FF6C26CB481D580FC1C023CF9474BE8B1CFACD553CE26106AC868A5E058204C8AB979999AE52EF6E5317479F5DEA1
                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                            Preview:.{"variations_compressed_seed":"H4sICCrd72UAA3NlZWQAzVrbb9vWGbeUpnWPc3Ho+BLHSeSkSV0lEkjqvqIoZMnXWrZKyUkwDFAp8lhiTJEqSclRwXVbh2F92EvRPQ/Duu0/6Nv+gGF/wl6Gve3P2Hd4kQ4pyZ6Bri2SSBT53fhdfuc73wmK5SUp1SxkODktZsUT+JZw7oSVM1wacyeFdJb5YwQtlfGJ2FMtrrup6tKporVqVk8e5CP7z9BbW5rYVLE8P9N8gO5tGmIfF+UmIRtj2k+g2bJiuuRy8wFzAfkcesu7OT8jrDCowCe5ZIpNZnKxmVh0Y2YjshHdeOOTCPMc3fEIHYElvdMRNdn0jVwbGSk3b6LrAaKgFjSSDHIV9IiWe9TRlKb+uqIbeFcxLd0Y+BrepTWsohXvMaGsYdGQ2gI2QUpI2WxsZqjqGN12dGxjLB93ZdHCvuyHtOxFtOCQHeIzc0QaFntlKPavERRzGHZ0vaXimtLS9rQqNjqKaSq65uuI0zruobvnsOw/pYI407zHnEscDiHHcRDDDPwNhfDPlzaUv4yh/KUMXQoYeoUy8w8/jmJYChQDbeB/omjueU89FYcu+0uUCi7/bQTNOzIPIEU3B5u6aMhQ4kIlm4vb8JmP26fko2Nl47be7erkvvMNNz+u8FzGNk5TrCmf2iaWDGzZHVG1dBPbBnx0RGNg7x7Ut1I8vxW3VcVs6pqtipqEVd2y97QTRVNeJ15mCxm7xbNZvte1Gn2u0ZIbZptvtD5tYCw2DFsSNU3XWnZ9q3R4lCjt5HkOLcmutxrNQaOlNgysydjABrMcr4iqktjJ8XHbu/zww1glzj9Ci1jzOWTcVyTc0MQOZlBRBm49nk2xzVn0puuu/aVAXs8y/v1wycai4HDi6l9H0OJWt4072BDVGtS72BoW7QO6oBg0H6bbjwW0Mcw4RTjg+QIEnOeSuVQg4L/5Hq1YCVgRLOBvoujWsY

                                                                                                                                                                                            Static File Info

                                                                                                                                                                                            General

                                                                                                                                                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                            Entropy (8bit):7.913845028849878
                                                                                                                                                                                            TrID:
                                                                                                                                                                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                            • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                            File name:BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            File size:1'446'992 bytes
                                                                                                                                                                                            MD5:e3e7498c2436a1570109fbe755af1d40
                                                                                                                                                                                            SHA1:d7fb79f465d2c87ef22088327b5bfb73899fdf7e
                                                                                                                                                                                            SHA256:498e27ed4e5bb584672992f459c0e51cd1e7345889dff1521ccf577b13ed6313
                                                                                                                                                                                            SHA512:4dd6025d4ebd1d4edeec077ee39e8704d2ed04ffd5f7ad83934a2ada8d0e3aefb15841b36ad0454e0c2cd6be12e13b2015de322d27059cb2fea8bb7f4a247096
                                                                                                                                                                                            SSDEEP:24576:w2hOU0p4qlWfBTfmRfanIT6lUScOWFohEp6Vvn6qtndPVmatCkbpmp:zhOJpP4JTm5T6lkFohDB6sndPVa6g
                                                                                                                                                                                            TLSH:C0652211B2D88031E6B31E3194F496755ABEFC741F30AA8F27849E3A5EB0582F674376
                                                                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........................Z.....................................................................~.............Rich...........

                                                                                                                                                                                            File Icon

                                                                                                                                                                                            Icon Hash:2f232d67b7934633

                                                                                                                                                                                            Static PE Info

                                                                                                                                                                                            General

                                                                                                                                                                                            Entrypoint:0x40699b
                                                                                                                                                                                            Entrypoint Section:.text
                                                                                                                                                                                            Digitally signed:true
                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                            Time Stamp:0x65E80F21 [Wed Mar 6 06:37:21 2024 UTC]
                                                                                                                                                                                            TLS Callbacks:
                                                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                                                            OS Version Major:5
                                                                                                                                                                                            OS Version Minor:1
                                                                                                                                                                                            File Version Major:5
                                                                                                                                                                                            File Version Minor:1
                                                                                                                                                                                            Subsystem Version Major:5
                                                                                                                                                                                            Subsystem Version Minor:1
                                                                                                                                                                                            Import Hash:c7edaf3f3d9b0b390b0f0473c7a8cf06

                                                                                                                                                                                            Authenticode Signature

                                                                                                                                                                                            Signature Valid:true
                                                                                                                                                                                            Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                                                                            Signature Validation Error:The operation completed successfully
                                                                                                                                                                                            Error Number:0
                                                                                                                                                                                            Not Before, Not After
                                                                                                                                                                                            • 06/06/2023 01:00:00 08/08/2024 00:59:59
                                                                                                                                                                                            Subject Chain
                                                                                                                                                                                            • CN="Brave Software, Inc.", O="Brave Software, Inc.", L=San Francisco, S=California, C=US
                                                                                                                                                                                            Version:3
                                                                                                                                                                                            Thumbprint MD5:16D12EA31FCCA2DB434A4CE2764212FB
                                                                                                                                                                                            Thumbprint SHA-1:8903F2BD47465A4F0F080AA7CEEC31A31B74DE42
                                                                                                                                                                                            Thumbprint SHA-256:9422AAD6EED2524B47A4E58D835AC34009EA3B76DD25155EFCCBD0CDB6C1EE88
                                                                                                                                                                                            Serial:031543E76CA971575EEDF22AA3719DCC

                                                                                                                                                                                            Entrypoint Preview

                                                                                                                                                                                            Instruction
                                                                                                                                                                                            call 00007F8FE138F7C8h
                                                                                                                                                                                            jmp 00007F8FE138F39Fh
                                                                                                                                                                                            push ebp
                                                                                                                                                                                            mov ebp, esp
                                                                                                                                                                                            mov eax, dword ptr [ebp+08h]
                                                                                                                                                                                            push esi
                                                                                                                                                                                            mov ecx, dword ptr [eax+3Ch]
                                                                                                                                                                                            add ecx, eax
                                                                                                                                                                                            movzx eax, word ptr [ecx+14h]
                                                                                                                                                                                            lea edx, dword ptr [ecx+18h]
                                                                                                                                                                                            add edx, eax
                                                                                                                                                                                            movzx eax, word ptr [ecx+06h]
                                                                                                                                                                                            imul esi, eax, 28h
                                                                                                                                                                                            add esi, edx
                                                                                                                                                                                            cmp edx, esi
                                                                                                                                                                                            je 00007F8FE138F53Bh
                                                                                                                                                                                            mov ecx, dword ptr [ebp+0Ch]
                                                                                                                                                                                            cmp ecx, dword ptr [edx+0Ch]
                                                                                                                                                                                            jc 00007F8FE138F52Ch
                                                                                                                                                                                            mov eax, dword ptr [edx+08h]
                                                                                                                                                                                            add eax, dword ptr [edx+0Ch]
                                                                                                                                                                                            cmp ecx, eax
                                                                                                                                                                                            jc 00007F8FE138F52Eh
                                                                                                                                                                                            add edx, 28h
                                                                                                                                                                                            cmp edx, esi
                                                                                                                                                                                            jne 00007F8FE138F50Ch
                                                                                                                                                                                            xor eax, eax
                                                                                                                                                                                            pop esi
                                                                                                                                                                                            pop ebp
                                                                                                                                                                                            ret
                                                                                                                                                                                            mov eax, edx
                                                                                                                                                                                            jmp 00007F8FE138F51Bh
                                                                                                                                                                                            push esi
                                                                                                                                                                                            call 00007F8FE138FCACh
                                                                                                                                                                                            test eax, eax
                                                                                                                                                                                            je 00007F8FE138F542h
                                                                                                                                                                                            mov eax, dword ptr fs:[00000018h]
                                                                                                                                                                                            mov esi, 0042396Ch
                                                                                                                                                                                            mov edx, dword ptr [eax+04h]
                                                                                                                                                                                            jmp 00007F8FE138F526h
                                                                                                                                                                                            cmp edx, eax
                                                                                                                                                                                            je 00007F8FE138F532h
                                                                                                                                                                                            xor eax, eax
                                                                                                                                                                                            mov ecx, edx
                                                                                                                                                                                            lock cmpxchg dword ptr [esi], ecx
                                                                                                                                                                                            test eax, eax
                                                                                                                                                                                            jne 00007F8FE138F512h
                                                                                                                                                                                            xor al, al
                                                                                                                                                                                            pop esi
                                                                                                                                                                                            ret
                                                                                                                                                                                            mov al, 01h
                                                                                                                                                                                            pop esi
                                                                                                                                                                                            ret
                                                                                                                                                                                            push ebp
                                                                                                                                                                                            mov ebp, esp
                                                                                                                                                                                            cmp dword ptr [ebp+08h], 00000000h
                                                                                                                                                                                            jne 00007F8FE138F529h
                                                                                                                                                                                            mov byte ptr [00423970h], 00000001h
                                                                                                                                                                                            call 00007F8FE138FA9Ah
                                                                                                                                                                                            call 00007F8FE139001Eh
                                                                                                                                                                                            test al, al
                                                                                                                                                                                            jne 00007F8FE138F526h
                                                                                                                                                                                            xor al, al
                                                                                                                                                                                            pop ebp
                                                                                                                                                                                            ret
                                                                                                                                                                                            call 00007F8FE1393206h
                                                                                                                                                                                            test al, al
                                                                                                                                                                                            jne 00007F8FE138F52Ch
                                                                                                                                                                                            push 00000000h
                                                                                                                                                                                            call 00007F8FE1390025h
                                                                                                                                                                                            pop ecx
                                                                                                                                                                                            jmp 00007F8FE138F50Bh
                                                                                                                                                                                            mov al, 01h
                                                                                                                                                                                            pop ebp
                                                                                                                                                                                            ret
                                                                                                                                                                                            push ebp
                                                                                                                                                                                            mov ebp, esp
                                                                                                                                                                                            cmp byte ptr [00423971h], 00000000h
                                                                                                                                                                                            je 00007F8FE138F526h
                                                                                                                                                                                            mov al, 01h

                                                                                                                                                                                            Data Directories

                                                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x21ae00x8c.rdata
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x250000x13673c.rsrc
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x15a0000x7450
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x15c0000x1508.reloc
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x20ce00x54.rdata
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x20e000x18.rdata
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x20d380x40.rdata
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x1a0000x1d4.rdata
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                            Sections

                                                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                            .text0x10000x18d200x18e00f6f6a8ebc9148ced19baf0cf8ce514c3False0.5874489635678392data6.645990561543334IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                            .rdata0x1a0000x85420x86003ed425119d83d29a9ea792647f00b190False0.4646688432835821data5.055308375977805IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                            .data0x230000x14540xa00905c57baa258d4dc27795aa058f06acaFalse0.175390625DOS executable (block device driver \277DN)2.379800202702836IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                            .rsrc0x250000x13673c0x136800ea570ee0e9f44be61c8e291d4d28b38dFalse0.9824376006441223data7.987680716387453IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                            .reloc0x15c0000x15080x1600c68100246f68f2ae3852dabe12991f75False0.7739701704545454data6.484253115308844IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                            Resources

                                                                                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                            B0x258240x12e1f8LZMA compressed data, non-streamed, size 81696031.0003108978271484
                                                                                                                                                                                            BRAVEUPDATE0x153a1c0x4data3.0
                                                                                                                                                                                            RT_ICON0x153a200x128Device independent bitmap graphic, 16 x 32 x 4, image size 192, 16 important colorsEnglishUnited States0.6317567567567568
                                                                                                                                                                                            RT_ICON0x153b480x568Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colorsEnglishUnited States0.5823699421965318
                                                                                                                                                                                            RT_ICON0x1540b00x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640, 16 important colorsEnglishUnited States0.5120967741935484
                                                                                                                                                                                            RT_ICON0x1543980x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.5455776173285198
                                                                                                                                                                                            RT_ICON0x154c400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1536EnglishUnited States0.36341463414634145
                                                                                                                                                                                            RT_ICON0x1552a80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2688EnglishUnited States0.42350746268656714
                                                                                                                                                                                            RT_STRING0x1561500x13eMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0ArabicSaudi Arabia0.6446540880503144
                                                                                                                                                                                            RT_STRING0x1562900x1aaMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0BulgarianBulgaria0.5
                                                                                                                                                                                            RT_STRING0x15643c0x196Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0CatalanSpain0.49507389162561577
                                                                                                                                                                                            RT_STRING0x1565d40xccMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0ChineseTaiwan0.7205882352941176
                                                                                                                                                                                            RT_STRING0x1566a00x18aMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0CzechCzech Republic0.5152284263959391
                                                                                                                                                                                            RT_STRING0x15682c0x15aMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0DanishDenmark0.5144508670520231
                                                                                                                                                                                            RT_STRING0x1569880x16aMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0GermanGermany0.5276243093922652
                                                                                                                                                                                            RT_STRING0x156af40x1b0Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0GreekGreece0.5462962962962963
                                                                                                                                                                                            RT_STRING0x156ca40x134Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0EnglishUnited States0.5324675324675324
                                                                                                                                                                                            RT_STRING0x156dd80x188Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FinnishFinland0.5102040816326531
                                                                                                                                                                                            RT_STRING0x156f600x1c0Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FrenchFrance0.45535714285714285
                                                                                                                                                                                            RT_STRING0x1571200x142Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0HebrewIsrael0.5590062111801242
                                                                                                                                                                                            RT_STRING0x1572640x164Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0HungarianHungary0.550561797752809
                                                                                                                                                                                            RT_STRING0x1573c80x150Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0IcelandicIceland0.5208333333333334
                                                                                                                                                                                            RT_STRING0x1575180x1b0Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0ItalianItaly0.45601851851851855
                                                                                                                                                                                            RT_STRING0x1576c80xfeMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0JapaneseJapan0.7125984251968503
                                                                                                                                                                                            RT_STRING0x1577c80xf2Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0KoreanNorth Korea0.7231404958677686
                                                                                                                                                                                            RT_STRING0x1577c80xf2Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0KoreanSouth Korea0.7231404958677686
                                                                                                                                                                                            RT_STRING0x1578bc0x1b0Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0DutchNetherlands0.44907407407407407
                                                                                                                                                                                            RT_STRING0x157a6c0x180Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0NorwegianNorway0.4713541666666667
                                                                                                                                                                                            RT_STRING0x157bec0x190Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0PolishPoland0.52
                                                                                                                                                                                            RT_STRING0x157d7c0x15eMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0PortugueseBrazil0.52
                                                                                                                                                                                            RT_STRING0x157edc0x1c6Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0RomanianRomania0.4713656387665198
                                                                                                                                                                                            RT_STRING0x1580a40x196Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0RussianRussia0.5492610837438424
                                                                                                                                                                                            RT_STRING0x15823c0x19cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0CroatianCroatia0.470873786407767
                                                                                                                                                                                            RT_STRING0x1583d80x180Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SlovakSlovakia0.5260416666666666
                                                                                                                                                                                            RT_STRING0x1585580x1a0Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SwedishSweden0.4639423076923077
                                                                                                                                                                                            RT_STRING0x1586f80x15aMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0ThaiThailand0.6011560693641619
                                                                                                                                                                                            RT_STRING0x1588540x15aMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0TurkishTurkey0.5260115606936416
                                                                                                                                                                                            RT_STRING0x1589b00x12cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0UrduPakistan0.6366666666666667
                                                                                                                                                                                            RT_STRING0x1589b00x12cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0UrduIndia0.6366666666666667
                                                                                                                                                                                            RT_STRING0x158adc0x178Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0IndonesianIndonesia0.5079787234042553
                                                                                                                                                                                            RT_STRING0x158c540x16eMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0UkrainianUkrain0.5601092896174863
                                                                                                                                                                                            RT_STRING0x158dc40x1bcMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SlovenianSlovenia0.4617117117117117
                                                                                                                                                                                            RT_STRING0x158f800x14cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0EstonianEstonia0.5271084337349398
                                                                                                                                                                                            RT_STRING0x1590cc0x1d8Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0LatvianLativa0.4661016949152542
                                                                                                                                                                                            RT_STRING0x1592a40x188Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0LithuanianLithuania0.48214285714285715
                                                                                                                                                                                            RT_STRING0x15942c0x138Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FarsiIran0.5833333333333334
                                                                                                                                                                                            RT_STRING0x15942c0x138Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FarsiAfganistan0.5833333333333334
                                                                                                                                                                                            RT_STRING0x15942c0x138Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FarsiTajikistan0.5833333333333334
                                                                                                                                                                                            RT_STRING0x15942c0x138Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FarsiUzbekistan0.5833333333333334
                                                                                                                                                                                            RT_STRING0x1595640x158Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0VietnameseVietnam0.5406976744186046
                                                                                                                                                                                            RT_STRING0x1596bc0x13cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0HindiIndia0.6139240506329114
                                                                                                                                                                                            RT_STRING0x1597f80x15cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0MalayMalaysia0.5086206896551724
                                                                                                                                                                                            RT_STRING0x1599540x172Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SwahiliKenya0.4972972972972973
                                                                                                                                                                                            RT_STRING0x1599540x172Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SwahiliMozambiq0.4972972972972973
                                                                                                                                                                                            RT_STRING0x159ac80x136Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0BengaliIndia0.6387096774193548
                                                                                                                                                                                            RT_STRING0x159c000x152Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0GujaratiIndia0.621301775147929
                                                                                                                                                                                            RT_STRING0x159d540x14eMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0TamilIndia0.6017964071856288
                                                                                                                                                                                            RT_STRING0x159d540x14eMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0TamilSri Lanka0.6017964071856288
                                                                                                                                                                                            RT_STRING0x159ea40x154Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0TeluguIndia0.6176470588235294
                                                                                                                                                                                            RT_STRING0x159ff80x156Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0KannadaKanada0.6403508771929824
                                                                                                                                                                                            RT_STRING0x15a1500x19aMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0MalayalamIndia0.5292682926829269
                                                                                                                                                                                            RT_STRING0x15a2ec0x178Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0MarathiIndia0.601063829787234
                                                                                                                                                                                            RT_STRING0x15a4640xf0Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0AmharicEthiopia0.7541666666666667
                                                                                                                                                                                            RT_STRING0x15a5540x17cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FilipinoPhilippines0.49473684210526314
                                                                                                                                                                                            RT_STRING0x15a6d00xceMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0ChineseChina0.7233009708737864
                                                                                                                                                                                            RT_STRING0x15a7a00x134Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0EnglishGreat Britain0.5324675324675324
                                                                                                                                                                                            RT_STRING0x15a8d40x152Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SpanishMexico0.5118343195266272
                                                                                                                                                                                            RT_STRING0x15aa280x188Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0PortuguesePortugal0.4872448979591837
                                                                                                                                                                                            RT_STRING0x15abb00x1aaMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 00.48826291079812206
                                                                                                                                                                                            RT_STRING0x15ad5c0x1beMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SerbianCyrillic0.5
                                                                                                                                                                                            RT_GROUP_ICON0x15af1c0x5adataEnglishUnited States0.7333333333333333
                                                                                                                                                                                            RT_VERSION0x15af780x334dataEnglishUnited States0.4292682926829268
                                                                                                                                                                                            RT_MANIFEST0x15b2ac0x48eXML 1.0 document, ASCII text0.43310463121783876

                                                                                                                                                                                            Imports

                                                                                                                                                                                            DLLImport
                                                                                                                                                                                            KERNEL32.dllInitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, GetCurrentProcess, TerminateProcess, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, RaiseException, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, OutputDebugStringW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, GetSystemTimeAsFileTime, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetFileType, GetStringTypeW, LCMapStringW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, ReadFile, CreateFileW, CloseHandle, WriteConsoleW, DecodePointer, lstrcpynW, CreateEventW, WaitForSingleObjectEx, ResetEvent, GetCurrentThreadId, GetCurrentProcessId, IsValidCodePage, QueryPerformanceCounter, CreateDirectoryW, SizeofResource, lstrlenW, RemoveDirectoryW, GetTempPathW, FormatMessageW, LockResource, DeleteFileW, FindResourceExW, LoadResource, FindResourceW, HeapDestroy, LocalFree, VerSetConditionMask, CopyFileW, VerifyVersionInfoW, GetTempFileNameW, lstrcmpiW, UnmapViewOfFile, CreateFileMappingW, MapViewOfFile, VirtualQuery, SetFilePointer, WaitForSingleObject, CreateProcessW, GetExitCodeProcess, SetEvent
                                                                                                                                                                                            SHLWAPI.dllPathQuoteSpacesW, PathAppendW, PathRemoveExtensionW, PathStripPathW
                                                                                                                                                                                            ADVAPI32.dllRegCreateKeyExW, RegSetValueExW, RegCloseKey
                                                                                                                                                                                            ole32.dllCoUninitialize, CoInitializeEx
                                                                                                                                                                                            SHELL32.dllSHGetFolderPathW
                                                                                                                                                                                            USER32.dllMessageBoxW, CharUpperBuffW, CharLowerBuffW

                                                                                                                                                                                            Possible Origin

                                                                                                                                                                                            Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                            EnglishUnited States
                                                                                                                                                                                            ArabicSaudi Arabia
                                                                                                                                                                                            BulgarianBulgaria
                                                                                                                                                                                            CatalanSpain
                                                                                                                                                                                            ChineseTaiwan
                                                                                                                                                                                            CzechCzech Republic
                                                                                                                                                                                            DanishDenmark
                                                                                                                                                                                            GermanGermany
                                                                                                                                                                                            GreekGreece
                                                                                                                                                                                            FinnishFinland
                                                                                                                                                                                            FrenchFrance
                                                                                                                                                                                            HebrewIsrael
                                                                                                                                                                                            HungarianHungary
                                                                                                                                                                                            IcelandicIceland
                                                                                                                                                                                            ItalianItaly
                                                                                                                                                                                            JapaneseJapan
                                                                                                                                                                                            KoreanNorth Korea
                                                                                                                                                                                            KoreanSouth Korea
                                                                                                                                                                                            DutchNetherlands
                                                                                                                                                                                            NorwegianNorway
                                                                                                                                                                                            PolishPoland
                                                                                                                                                                                            PortugueseBrazil
                                                                                                                                                                                            RomanianRomania
                                                                                                                                                                                            RussianRussia
                                                                                                                                                                                            CroatianCroatia
                                                                                                                                                                                            SlovakSlovakia
                                                                                                                                                                                            SwedishSweden
                                                                                                                                                                                            ThaiThailand
                                                                                                                                                                                            TurkishTurkey
                                                                                                                                                                                            UrduPakistan
                                                                                                                                                                                            UrduIndia
                                                                                                                                                                                            IndonesianIndonesia
                                                                                                                                                                                            UkrainianUkrain
                                                                                                                                                                                            SlovenianSlovenia
                                                                                                                                                                                            EstonianEstonia
                                                                                                                                                                                            LatvianLativa
                                                                                                                                                                                            LithuanianLithuania
                                                                                                                                                                                            FarsiIran
                                                                                                                                                                                            FarsiAfganistan
                                                                                                                                                                                            FarsiTajikistan
                                                                                                                                                                                            FarsiUzbekistan
                                                                                                                                                                                            VietnameseVietnam
                                                                                                                                                                                            MalayMalaysia
                                                                                                                                                                                            SwahiliKenya
                                                                                                                                                                                            SwahiliMozambiq
                                                                                                                                                                                            TamilSri Lanka
                                                                                                                                                                                            KannadaKanada
                                                                                                                                                                                            AmharicEthiopia
                                                                                                                                                                                            FilipinoPhilippines
                                                                                                                                                                                            ChineseChina
                                                                                                                                                                                            EnglishGreat Britain
                                                                                                                                                                                            SpanishMexico
                                                                                                                                                                                            PortuguesePortugal
                                                                                                                                                                                            SerbianCyrillic

                                                                                                                                                                                            Network Behavior

                                                                                                                                                                                            ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                            Statistics

                                                                                                                                                                                            CPU Usage

                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                            Memory Usage

                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                            High Level Behavior Distribution

                                                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                                                            Behavior

                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                            System Behavior

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:0
                                                                                                                                                                                            Start time:09:11:28
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                            Imagebase:0x8d0000
                                                                                                                                                                                            File size:1'446'992 bytes
                                                                                                                                                                                            MD5 hash:E3E7498C2436A1570109FBE755AF1D40
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:1
                                                                                                                                                                                            Start time:09:11:29
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:C:\Program Files (x86)\BraveSoftware\Temp\GUM4668.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none
                                                                                                                                                                                            Imagebase:0x3d0000
                                                                                                                                                                                            File size:175'424 bytes
                                                                                                                                                                                            MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                                                                                            • Detection: 1%, Virustotal, Browse
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:2
                                                                                                                                                                                            Start time:09:11:33
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
                                                                                                                                                                                            Imagebase:0x9d0000
                                                                                                                                                                                            File size:175'424 bytes
                                                                                                                                                                                            MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:3
                                                                                                                                                                                            Start time:09:11:33
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
                                                                                                                                                                                            Imagebase:0x9d0000
                                                                                                                                                                                            File size:175'424 bytes
                                                                                                                                                                                            MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:4
                                                                                                                                                                                            Start time:09:11:34
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe"
                                                                                                                                                                                            Imagebase:0x7ff7682c0000
                                                                                                                                                                                            File size:195'392 bytes
                                                                                                                                                                                            MD5 hash:F2CA542F38E6B51EDB9790369117F54A
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:5
                                                                                                                                                                                            Start time:09:11:34
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe"
                                                                                                                                                                                            Imagebase:0x7ff7682c0000
                                                                                                                                                                                            File size:195'392 bytes
                                                                                                                                                                                            MD5 hash:F2CA542F38E6B51EDB9790369117F54A
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:6
                                                                                                                                                                                            Start time:09:11:34
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c
                                                                                                                                                                                            Imagebase:0x9d0000
                                                                                                                                                                                            File size:175'424 bytes
                                                                                                                                                                                            MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:7
                                                                                                                                                                                            Start time:09:11:34
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler
                                                                                                                                                                                            Imagebase:0x9d0000
                                                                                                                                                                                            File size:175'424 bytes
                                                                                                                                                                                            MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:8
                                                                                                                                                                                            Start time:09:11:34
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe"
                                                                                                                                                                                            Imagebase:0x7ff7682c0000
                                                                                                                                                                                            File size:195'392 bytes
                                                                                                                                                                                            MD5 hash:F2CA542F38E6B51EDB9790369117F54A
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:9
                                                                                                                                                                                            Start time:09:11:35
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /uninstall
                                                                                                                                                                                            Imagebase:0x9d0000
                                                                                                                                                                                            File size:175'424 bytes
                                                                                                                                                                                            MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:10
                                                                                                                                                                                            Start time:09:11:35
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTQ1IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE0NSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins5NTcyRUI5Qy1DQUU1LTQxOTgtQjNEOS0yODE3MDM5MzdEQzl9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7QkI0OTE1OUQtMjIxNi00MkQ4LUFFRTAtRTg3NDAxOEQ5RDA1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjIwMDYiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE0NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI1NDA2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                                                                                                            Imagebase:0x9d0000
                                                                                                                                                                                            File size:175'424 bytes
                                                                                                                                                                                            MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:11
                                                                                                                                                                                            Start time:09:11:35
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{9572EB9C-CAE5-4198-B3D9-281703937DC9}
                                                                                                                                                                                            Imagebase:0x9d0000
                                                                                                                                                                                            File size:175'424 bytes
                                                                                                                                                                                            MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:12
                                                                                                                                                                                            Start time:09:11:35
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
                                                                                                                                                                                            Imagebase:0x9d0000
                                                                                                                                                                                            File size:175'424 bytes
                                                                                                                                                                                            MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:13
                                                                                                                                                                                            Start time:09:11:36
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
                                                                                                                                                                                            Imagebase:0xc50000
                                                                                                                                                                                            File size:116'032 bytes
                                                                                                                                                                                            MD5 hash:088EBFFD13539DBEF1204243C3558999
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:14
                                                                                                                                                                                            Start time:09:11:36
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
                                                                                                                                                                                            Imagebase:0x9d0000
                                                                                                                                                                                            File size:175'424 bytes
                                                                                                                                                                                            MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:15
                                                                                                                                                                                            Start time:09:11:36
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                            Imagebase:0x7ff626f70000
                                                                                                                                                                                            File size:834'512 bytes
                                                                                                                                                                                            MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:16
                                                                                                                                                                                            Start time:09:11:36
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:9474 /prefetch:2
                                                                                                                                                                                            Imagebase:0x9f0000
                                                                                                                                                                                            File size:828'368 bytes
                                                                                                                                                                                            MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:17
                                                                                                                                                                                            Start time:09:11:36
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                            Imagebase:0x7ff6eef20000
                                                                                                                                                                                            File size:55'320 bytes
                                                                                                                                                                                            MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:18
                                                                                                                                                                                            Start time:09:11:37
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c
                                                                                                                                                                                            Imagebase:0x7ff6a9630000
                                                                                                                                                                                            File size:540'712 bytes
                                                                                                                                                                                            MD5 hash:89CF8972D683795DAB6901BC9456675D
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:19
                                                                                                                                                                                            Start time:09:11:37
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c
                                                                                                                                                                                            Imagebase:0x7ff6a9630000
                                                                                                                                                                                            File size:540'712 bytes
                                                                                                                                                                                            MD5 hash:89CF8972D683795DAB6901BC9456675D
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:20
                                                                                                                                                                                            Start time:09:11:38
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
                                                                                                                                                                                            Imagebase:0xb00000
                                                                                                                                                                                            File size:85'632 bytes
                                                                                                                                                                                            MD5 hash:F9A898A606E7F5A1CD7CFFA8079253A0
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:21
                                                                                                                                                                                            Start time:09:11:38
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
                                                                                                                                                                                            Imagebase:0xb00000
                                                                                                                                                                                            File size:85'632 bytes
                                                                                                                                                                                            MD5 hash:F9A898A606E7F5A1CD7CFFA8079253A0
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:22
                                                                                                                                                                                            Start time:09:11:38
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2042c
                                                                                                                                                                                            Imagebase:0x7ff67dcd0000
                                                                                                                                                                                            File size:4'210'216 bytes
                                                                                                                                                                                            MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:23
                                                                                                                                                                                            Start time:09:11:39
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2720 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:3
                                                                                                                                                                                            Imagebase:0x7ff67dcd0000
                                                                                                                                                                                            File size:4'210'216 bytes
                                                                                                                                                                                            MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:25
                                                                                                                                                                                            Start time:09:11:41
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
                                                                                                                                                                                            Imagebase:0xc50000
                                                                                                                                                                                            File size:116'032 bytes
                                                                                                                                                                                            MD5 hash:088EBFFD13539DBEF1204243C3558999
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:26
                                                                                                                                                                                            Start time:09:11:41
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
                                                                                                                                                                                            Imagebase:0x9d0000
                                                                                                                                                                                            File size:175'424 bytes
                                                                                                                                                                                            MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:27
                                                                                                                                                                                            Start time:09:11:42
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                            Imagebase:0x7ff626f70000
                                                                                                                                                                                            File size:834'512 bytes
                                                                                                                                                                                            MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:28
                                                                                                                                                                                            Start time:09:11:42
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:75012 /prefetch:2
                                                                                                                                                                                            Imagebase:0x9f0000
                                                                                                                                                                                            File size:828'368 bytes
                                                                                                                                                                                            MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:29
                                                                                                                                                                                            Start time:09:11:44
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6136 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:8
                                                                                                                                                                                            Imagebase:0x7ff67dcd0000
                                                                                                                                                                                            File size:4'210'216 bytes
                                                                                                                                                                                            MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:31
                                                                                                                                                                                            Start time:09:11:47
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
                                                                                                                                                                                            Imagebase:0xb00000
                                                                                                                                                                                            File size:85'632 bytes
                                                                                                                                                                                            MD5 hash:F9A898A606E7F5A1CD7CFFA8079253A0
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:32
                                                                                                                                                                                            Start time:09:11:47
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
                                                                                                                                                                                            Imagebase:0xb00000
                                                                                                                                                                                            File size:85'632 bytes
                                                                                                                                                                                            MD5 hash:F9A898A606E7F5A1CD7CFFA8079253A0
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:33
                                                                                                                                                                                            Start time:09:11:50
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5980 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:8
                                                                                                                                                                                            Imagebase:0x7ff6bf2e0000
                                                                                                                                                                                            File size:1'255'976 bytes
                                                                                                                                                                                            MD5 hash:76C58E5BABFE4ACF0308AA646FC0F416
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:34
                                                                                                                                                                                            Start time:09:11:50
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5980 --field-trial-handle=2024,i,18085869784470455898,17984012463828582679,262144 /prefetch:8
                                                                                                                                                                                            Imagebase:0x7ff6bf2e0000
                                                                                                                                                                                            File size:1'255'976 bytes
                                                                                                                                                                                            MD5 hash:76C58E5BABFE4ACF0308AA646FC0F416
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:37
                                                                                                                                                                                            Start time:09:11:56
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:1316108 /prefetch:2
                                                                                                                                                                                            Imagebase:0x9f0000
                                                                                                                                                                                            File size:828'368 bytes
                                                                                                                                                                                            MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:38
                                                                                                                                                                                            Start time:09:12:00
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                                                                                                                            Imagebase:0x7ff67dcd0000
                                                                                                                                                                                            File size:4'210'216 bytes
                                                                                                                                                                                            MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:39
                                                                                                                                                                                            Start time:09:12:02
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2112,i,6464033333700142312,7804436323519571183,262144 /prefetch:3
                                                                                                                                                                                            Imagebase:0x7ff67dcd0000
                                                                                                                                                                                            File size:4'210'216 bytes
                                                                                                                                                                                            MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:40
                                                                                                                                                                                            Start time:09:12:08
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                                                                                                                            Imagebase:0x7ff67dcd0000
                                                                                                                                                                                            File size:4'210'216 bytes
                                                                                                                                                                                            MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:41
                                                                                                                                                                                            Start time:09:12:09
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1680,i,16366133740763225394,16074541782411448469,262144 /prefetch:3
                                                                                                                                                                                            Imagebase:0x7ff67dcd0000
                                                                                                                                                                                            File size:4'210'216 bytes
                                                                                                                                                                                            MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:42
                                                                                                                                                                                            Start time:09:12:11
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
                                                                                                                                                                                            Imagebase:0xc50000
                                                                                                                                                                                            File size:116'032 bytes
                                                                                                                                                                                            MD5 hash:088EBFFD13539DBEF1204243C3558999
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:43
                                                                                                                                                                                            Start time:09:12:11
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
                                                                                                                                                                                            Imagebase:0x9d0000
                                                                                                                                                                                            File size:175'424 bytes
                                                                                                                                                                                            MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:44
                                                                                                                                                                                            Start time:09:12:11
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                            Imagebase:0x7ff626f70000
                                                                                                                                                                                            File size:834'512 bytes
                                                                                                                                                                                            MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:45
                                                                                                                                                                                            Start time:09:12:11
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:9482 /prefetch:2
                                                                                                                                                                                            Imagebase:0x9f0000
                                                                                                                                                                                            File size:828'368 bytes
                                                                                                                                                                                            MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:46
                                                                                                                                                                                            Start time:09:12:17
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exe
                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                            Commandline:C:\Program Files (x86)\BraveSoftware\Update\Install\{74FC6E73-770F-49D8-B6ED-2CE2A518185D}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Windows\TEMP\gui4A8.tmp
                                                                                                                                                                                            Imagebase:0x7ff6aa520000
                                                                                                                                                                                            File size:124'775'448 bytes
                                                                                                                                                                                            MD5 hash:40976C35E6CA27871F134A8A2FCAFC21
                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            General

                                                                                                                                                                                            Target ID:47
                                                                                                                                                                                            Start time:09:12:17
                                                                                                                                                                                            Start date:14/03/2024
                                                                                                                                                                                            Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe
                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
                                                                                                                                                                                            Imagebase:0xc50000
                                                                                                                                                                                            File size:116'032 bytes
                                                                                                                                                                                            MD5 hash:088EBFFD13539DBEF1204243C3558999
                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                            Disassembly

                                                                                                                                                                                            Reset < >

                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                              Execution Coverage:9.9%
                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                              Signature Coverage:7%
                                                                                                                                                                                              Total number of Nodes:2000
                                                                                                                                                                                              Total number of Limit Nodes:34
                                                                                                                                                                                              execution_graph 12143 8d681f 12144 8d682b CallCatchBlock 12143->12144 12171 8d6a1b 12144->12171 12146 8d6985 12243 8d6d06 IsProcessorFeaturePresent 12146->12243 12147 8d6832 12147->12146 12159 8d685c ___scrt_is_nonwritable_in_current_image _unexpected ___scrt_release_startup_lock 12147->12159 12149 8d698c 12222 8da133 12149->12222 12154 8d687b 12155 8d68fc 12182 8d6e21 12155->12182 12159->12154 12159->12155 12225 8da10d 12159->12225 12166 8d6922 12167 8d692b 12166->12167 12234 8da0e8 12166->12234 12237 8d6b8c 12167->12237 12172 8d6a24 12171->12172 12250 8d6fa5 IsProcessorFeaturePresent 12172->12250 12176 8d6a35 12181 8d6a39 12176->12181 12260 8da723 12176->12260 12179 8d6a50 12179->12147 12181->12147 12353 8d7760 12182->12353 12184 8d6e34 GetStartupInfoW 12185 8d6902 12184->12185 12186 8d9d7a 12185->12186 12355 8ded7d 12186->12355 12188 8d690a 12191 8d277b GetModuleHandleW GetProcAddress 12188->12191 12189 8d9d83 12189->12188 12361 8df0b1 12189->12361 12192 8d27a7 CoInitializeEx 12191->12192 12193 8d27a0 12191->12193 12194 8d27c5 12192->12194 12195 8d27ba 12192->12195 12193->12192 12938 8d254e 12194->12938 12782 8d1444 12195->12782 12200 8d27d5 12787 8d2604 12200->12787 12212 8d280f 12213 8d2bff 59 API calls 12212->12213 12214 8d2828 12213->12214 12215 8d2bff 59 API calls 12214->12215 12216 8d2831 12215->12216 12842 8d1935 12216->12842 13970 8d9f5e 12222->13970 12226 8da7c4 CallCatchBlock 12225->12226 12227 8da123 __dosmaperr 12225->12227 12228 8dd6f0 _unexpected 43 API calls 12226->12228 12227->12155 12231 8da7d5 12228->12231 12229 8da880 CallUnexpected 43 API calls 12230 8da7ff 12229->12230 12231->12229 12232 8d6e57 GetModuleHandleW 12233 8d691e 12232->12233 12233->12149 12233->12166 12235 8d9f5e _unexpected 23 API calls 12234->12235 12236 8da0f3 12235->12236 12236->12167 12238 8d6b98 12237->12238 12242 8d6933 12238->12242 14045 8da735 12238->14045 12240 8d6ba6 12241 8d754d ___scrt_uninitialize_crt 7 API calls 12240->12241 12241->12242 12242->12154 12244 8d6d1c _unexpected 12243->12244 12245 8d6dc7 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 12244->12245 12246 8d6e12 _unexpected 12245->12246 12246->12149 12247 8da0f7 12248 8d9f5e _unexpected 23 API calls 12247->12248 12249 8d699a 12248->12249 12251 8d6a30 12250->12251 12252 8d752e 12251->12252 12269 8d7b61 12252->12269 12255 8d7537 12255->12176 12257 8d753f 12258 8d754a 12257->12258 12283 8d7b9d 12257->12283 12258->12176 12325 8e0781 12260->12325 12263 8d754d 12264 8d7556 12263->12264 12265 8d7560 12263->12265 12266 8d7b46 ___vcrt_uninitialize_ptd 6 API calls 12264->12266 12265->12181 12267 8d755b 12266->12267 12268 8d7b9d ___vcrt_uninitialize_locks DeleteCriticalSection 12267->12268 12268->12265 12271 8d7b6a 12269->12271 12272 8d7b93 12271->12272 12273 8d7533 12271->12273 12287 8d7dd5 12271->12287 12274 8d7b9d ___vcrt_uninitialize_locks DeleteCriticalSection 12272->12274 12273->12255 12275 8d7b13 12273->12275 12274->12273 12306 8d7ce6 12275->12306 12280 8d7b43 12280->12257 12282 8d7b28 12282->12257 12284 8d7bc7 12283->12284 12285 8d7ba8 12283->12285 12284->12255 12286 8d7bb2 DeleteCriticalSection 12285->12286 12286->12284 12286->12286 12292 8d7c9d 12287->12292 12290 8d7e0d InitializeCriticalSectionAndSpinCount 12291 8d7df8 12290->12291 12291->12271 12293 8d7cb5 12292->12293 12294 8d7cd8 12292->12294 12293->12294 12298 8d7c03 12293->12298 12294->12290 12294->12291 12297 8d7cca GetProcAddress 12297->12294 12303 8d7c0f 12298->12303 12299 8d7c83 12299->12294 12299->12297 12300 8d7c25 LoadLibraryExW 12301 8d7c8a 12300->12301 12302 8d7c43 GetLastError 12300->12302 12301->12299 12304 8d7c92 FreeLibrary 12301->12304 12302->12303 12303->12299 12303->12300 12305 8d7c65 LoadLibraryExW 12303->12305 12304->12299 12305->12301 12305->12303 12307 8d7c9d ___vcrt_FlsFree 5 API calls 12306->12307 12308 8d7d00 12307->12308 12309 8d7d19 TlsAlloc 12308->12309 12310 8d7b1d 12308->12310 12310->12282 12311 8d7d97 12310->12311 12312 8d7c9d ___vcrt_FlsFree 5 API calls 12311->12312 12313 8d7db1 12312->12313 12314 8d7dcc TlsSetValue 12313->12314 12315 8d7b36 12313->12315 12314->12315 12315->12280 12316 8d7b46 12315->12316 12317 8d7b56 12316->12317 12318 8d7b50 12316->12318 12317->12282 12320 8d7d21 12318->12320 12321 8d7c9d ___vcrt_FlsFree 5 API calls 12320->12321 12322 8d7d3b 12321->12322 12323 8d7d53 TlsFree 12322->12323 12324 8d7d47 12322->12324 12323->12324 12324->12317 12326 8e0791 12325->12326 12327 8d6a42 12325->12327 12326->12327 12329 8df7c8 12326->12329 12327->12179 12327->12263 12330 8df7d4 CallCatchBlock 12329->12330 12339 8df32d EnterCriticalSection 12330->12339 12332 8df7db 12338 8df7f9 12332->12338 12340 8df662 GetStartupInfoW 12332->12340 12349 8df81f 12338->12349 12339->12332 12341 8df713 12340->12341 12342 8df67f 12340->12342 12344 8df718 12341->12344 12342->12341 12343 8df6d7 GetFileType 12342->12343 12343->12342 12345 8df71f 12344->12345 12346 8df762 GetStdHandle 12345->12346 12347 8df7c4 12345->12347 12348 8df775 GetFileType 12345->12348 12346->12345 12347->12338 12348->12345 12352 8df375 LeaveCriticalSection 12349->12352 12351 8df80a 12351->12326 12352->12351 12354 8d7777 12353->12354 12354->12184 12354->12354 12356 8ded86 12355->12356 12357 8dedb8 12355->12357 12364 8dd7ab 12356->12364 12357->12189 12779 8df061 12361->12779 12365 8dd7bc 12364->12365 12366 8dd7b6 12364->12366 12368 8e0589 __dosmaperr 6 API calls 12365->12368 12385 8dd7c2 12365->12385 12367 8e054a __dosmaperr 6 API calls 12366->12367 12367->12365 12369 8dd7d6 12368->12369 12371 8ddd11 __dosmaperr 14 API calls 12369->12371 12369->12385 12373 8dd7e6 12371->12373 12374 8dd7ee 12373->12374 12375 8dd803 12373->12375 12377 8e0589 __dosmaperr 6 API calls 12374->12377 12376 8e0589 __dosmaperr 6 API calls 12375->12376 12378 8dd80f 12376->12378 12379 8dd7fa 12377->12379 12380 8dd813 12378->12380 12381 8dd822 12378->12381 12382 8ddd6e ___free_lconv_mon 14 API calls 12379->12382 12383 8e0589 __dosmaperr 6 API calls 12380->12383 12384 8dd51e __dosmaperr 14 API calls 12381->12384 12382->12385 12383->12379 12386 8dd82d 12384->12386 12388 8dd7c7 12385->12388 12412 8da880 12385->12412 12387 8ddd6e ___free_lconv_mon 14 API calls 12386->12387 12387->12388 12389 8deb88 12388->12389 12577 8decdd 12389->12577 12396 8debe4 12398 8ddd6e ___free_lconv_mon 14 API calls 12396->12398 12397 8debf2 12602 8dedd8 12397->12602 12400 8debcb 12398->12400 12400->12357 12402 8dec2a 12403 8ddcfe __dosmaperr 14 API calls 12402->12403 12404 8dec2f 12403->12404 12406 8ddd6e ___free_lconv_mon 14 API calls 12404->12406 12405 8dec71 12408 8decba 12405->12408 12613 8de7fa 12405->12613 12406->12400 12407 8dec45 12407->12405 12410 8ddd6e ___free_lconv_mon 14 API calls 12407->12410 12409 8ddd6e ___free_lconv_mon 14 API calls 12408->12409 12409->12400 12410->12405 12423 8e0980 12412->12423 12415 8da890 12417 8da89a IsProcessorFeaturePresent 12415->12417 12422 8da8b9 12415->12422 12418 8da8a6 12417->12418 12453 8dda04 12418->12453 12419 8da0f7 _unexpected 23 API calls 12420 8da8c3 12419->12420 12422->12419 12459 8e08b2 12423->12459 12426 8e09c5 12427 8e09d1 CallCatchBlock 12426->12427 12428 8dd841 __dosmaperr 14 API calls 12427->12428 12429 8e09f8 _unexpected 12427->12429 12433 8e09fe _unexpected 12427->12433 12428->12429 12430 8e0a45 12429->12430 12429->12433 12452 8e0a2f 12429->12452 12431 8ddcfe __dosmaperr 14 API calls 12430->12431 12432 8e0a4a 12431->12432 12470 8ddc00 12432->12470 12435 8e0a71 12433->12435 12472 8df32d EnterCriticalSection 12433->12472 12438 8e0ba4 12435->12438 12439 8e0ab3 12435->12439 12449 8e0ae2 12435->12449 12440 8e0baf 12438->12440 12504 8df375 LeaveCriticalSection 12438->12504 12439->12449 12473 8dd6f0 GetLastError 12439->12473 12443 8da0f7 _unexpected 23 API calls 12440->12443 12445 8e0bb7 12443->12445 12446 8dd6f0 _unexpected 43 API calls 12450 8e0b37 12446->12450 12448 8dd6f0 _unexpected 43 API calls 12448->12449 12500 8e0b51 12449->12500 12451 8dd6f0 _unexpected 43 API calls 12450->12451 12450->12452 12451->12452 12452->12415 12454 8dda20 _unexpected 12453->12454 12455 8dda4c IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 12454->12455 12456 8ddb1d _unexpected 12455->12456 12569 8d7182 12456->12569 12458 8ddb3b 12458->12422 12460 8e08be CallCatchBlock 12459->12460 12465 8df32d EnterCriticalSection 12460->12465 12462 8e08cc 12466 8e090a 12462->12466 12465->12462 12469 8df375 LeaveCriticalSection 12466->12469 12468 8da885 12468->12415 12468->12426 12469->12468 12505 8ddb4c 12470->12505 12472->12435 12474 8dd706 12473->12474 12475 8dd70c 12473->12475 12476 8e054a __dosmaperr 6 API calls 12474->12476 12477 8e0589 __dosmaperr 6 API calls 12475->12477 12479 8dd710 SetLastError 12475->12479 12476->12475 12478 8dd728 12477->12478 12478->12479 12481 8ddd11 __dosmaperr 14 API calls 12478->12481 12483 8dd7a5 12479->12483 12484 8dd7a0 12479->12484 12482 8dd73d 12481->12482 12485 8dd745 12482->12485 12486 8dd756 12482->12486 12487 8da880 CallUnexpected 41 API calls 12483->12487 12484->12448 12488 8e0589 __dosmaperr 6 API calls 12485->12488 12489 8e0589 __dosmaperr 6 API calls 12486->12489 12490 8dd7aa 12487->12490 12491 8dd753 12488->12491 12492 8dd762 12489->12492 12497 8ddd6e ___free_lconv_mon 14 API calls 12491->12497 12493 8dd77d 12492->12493 12494 8dd766 12492->12494 12495 8dd51e __dosmaperr 14 API calls 12493->12495 12496 8e0589 __dosmaperr 6 API calls 12494->12496 12498 8dd788 12495->12498 12496->12491 12497->12479 12499 8ddd6e ___free_lconv_mon 14 API calls 12498->12499 12499->12479 12501 8e0b28 12500->12501 12502 8e0b57 12500->12502 12501->12446 12501->12450 12501->12452 12568 8df375 LeaveCriticalSection 12502->12568 12504->12440 12506 8ddb5e ___std_exception_copy 12505->12506 12511 8ddb83 12506->12511 12512 8ddb9a 12511->12512 12513 8ddb93 12511->12513 12517 8ddb76 12512->12517 12530 8dd9db 12512->12530 12526 8dbe90 GetLastError 12513->12526 12516 8ddbcf 12516->12517 12533 8ddc2d IsProcessorFeaturePresent 12516->12533 12520 8dbce0 12517->12520 12519 8ddbff 12521 8dbcec 12520->12521 12523 8dbd03 12521->12523 12559 8dbee0 12521->12559 12524 8dbd16 12523->12524 12525 8dbee0 ___std_exception_copy 43 API calls 12523->12525 12525->12524 12527 8dbea9 12526->12527 12537 8dd8f2 12527->12537 12531 8dd9ff 12530->12531 12532 8dd9e6 GetLastError SetLastError 12530->12532 12531->12516 12532->12516 12534 8ddc39 12533->12534 12535 8dda04 _unexpected 8 API calls 12534->12535 12536 8ddc4e GetCurrentProcess TerminateProcess 12535->12536 12536->12519 12538 8dd90b 12537->12538 12539 8dd905 12537->12539 12541 8e0589 __dosmaperr 6 API calls 12538->12541 12558 8dbec5 SetLastError 12538->12558 12540 8e054a __dosmaperr 6 API calls 12539->12540 12540->12538 12542 8dd925 12541->12542 12543 8ddd11 __dosmaperr 14 API calls 12542->12543 12542->12558 12544 8dd935 12543->12544 12545 8dd93d 12544->12545 12546 8dd952 12544->12546 12548 8e0589 __dosmaperr 6 API calls 12545->12548 12547 8e0589 __dosmaperr 6 API calls 12546->12547 12549 8dd95e 12547->12549 12550 8dd949 12548->12550 12551 8dd971 12549->12551 12552 8dd962 12549->12552 12553 8ddd6e ___free_lconv_mon 14 API calls 12550->12553 12555 8dd51e __dosmaperr 14 API calls 12551->12555 12554 8e0589 __dosmaperr 6 API calls 12552->12554 12553->12558 12554->12550 12556 8dd97c 12555->12556 12557 8ddd6e ___free_lconv_mon 14 API calls 12556->12557 12557->12558 12558->12512 12560 8dbf2f 12559->12560 12561 8dbeee GetLastError 12559->12561 12560->12523 12562 8dbefd 12561->12562 12563 8dd8f2 ___std_exception_copy 14 API calls 12562->12563 12564 8dbf1a SetLastError 12563->12564 12564->12560 12565 8dbf36 12564->12565 12566 8da880 CallUnexpected 41 API calls 12565->12566 12567 8dbf3b 12566->12567 12568->12501 12570 8d718b IsProcessorFeaturePresent 12569->12570 12571 8d718a 12569->12571 12573 8d71cd 12570->12573 12571->12458 12576 8d7190 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 12573->12576 12575 8d72b0 12575->12458 12576->12575 12578 8dece9 CallCatchBlock 12577->12578 12579 8ded03 12578->12579 12621 8df32d EnterCriticalSection 12578->12621 12581 8debb2 12579->12581 12583 8da880 CallUnexpected 43 API calls 12579->12583 12588 8de908 12581->12588 12582 8ded3f 12622 8ded5c 12582->12622 12585 8ded7c 12583->12585 12586 8ded13 12586->12582 12587 8ddd6e ___free_lconv_mon 14 API calls 12586->12587 12587->12582 12626 8de408 12588->12626 12591 8de929 GetOEMCP 12593 8de952 12591->12593 12592 8de93b 12592->12593 12594 8de940 GetACP 12592->12594 12593->12400 12595 8dfae8 12593->12595 12594->12593 12596 8dfb26 12595->12596 12600 8dfaf6 __dosmaperr 12595->12600 12598 8ddcfe __dosmaperr 14 API calls 12596->12598 12597 8dfb11 RtlAllocateHeap 12599 8debdc 12597->12599 12597->12600 12598->12599 12599->12396 12599->12397 12600->12596 12600->12597 12601 8e0829 __dosmaperr 2 API calls 12600->12601 12601->12600 12603 8de908 45 API calls 12602->12603 12604 8dedf8 12603->12604 12605 8dee35 IsValidCodePage 12604->12605 12611 8dee71 _unexpected 12604->12611 12607 8dee47 12605->12607 12605->12611 12606 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 12608 8dec1f 12606->12608 12609 8dee76 GetCPInfo 12607->12609 12612 8dee50 _unexpected 12607->12612 12608->12402 12608->12407 12609->12611 12609->12612 12611->12606 12669 8de9dc 12612->12669 12614 8de806 CallCatchBlock 12613->12614 12753 8df32d EnterCriticalSection 12614->12753 12616 8de810 12754 8de847 12616->12754 12621->12586 12625 8df375 LeaveCriticalSection 12622->12625 12624 8ded63 12624->12579 12625->12624 12627 8de426 12626->12627 12628 8de41f 12626->12628 12627->12628 12629 8dd6f0 _unexpected 43 API calls 12627->12629 12628->12591 12628->12592 12630 8de447 12629->12630 12634 8e14cc 12630->12634 12635 8e14df 12634->12635 12636 8de45d 12634->12636 12635->12636 12642 8e0200 12635->12642 12638 8e152a 12636->12638 12639 8e153d 12638->12639 12641 8e1552 12638->12641 12639->12641 12664 8dedc5 12639->12664 12641->12628 12643 8e020c CallCatchBlock 12642->12643 12644 8dd6f0 _unexpected 43 API calls 12643->12644 12645 8e0215 12644->12645 12646 8e025b 12645->12646 12655 8df32d EnterCriticalSection 12645->12655 12646->12636 12648 8e0233 12656 8e0281 12648->12656 12653 8da880 CallUnexpected 43 API calls 12654 8e0280 12653->12654 12655->12648 12657 8e0244 12656->12657 12658 8e028f __dosmaperr 12656->12658 12660 8e0260 12657->12660 12658->12657 12659 8dffb4 __dosmaperr 14 API calls 12658->12659 12659->12657 12663 8df375 LeaveCriticalSection 12660->12663 12662 8e0257 12662->12646 12662->12653 12663->12662 12665 8dd6f0 _unexpected 43 API calls 12664->12665 12666 8dedca 12665->12666 12667 8decdd ___scrt_uninitialize_crt 43 API calls 12666->12667 12668 8dedd5 12667->12668 12668->12641 12670 8dea04 GetCPInfo 12669->12670 12679 8deacd 12669->12679 12671 8dea1c 12670->12671 12670->12679 12680 8dfe0e 12671->12680 12672 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 12675 8deb86 12672->12675 12675->12611 12678 8e2b92 47 API calls 12678->12679 12679->12672 12681 8de408 43 API calls 12680->12681 12682 8dfe2e 12681->12682 12700 8df0e2 12682->12700 12684 8dfef2 12687 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 12684->12687 12685 8dfeea 12703 8dff17 12685->12703 12686 8dfe5b 12686->12684 12686->12685 12689 8dfae8 15 API calls 12686->12689 12691 8dfe80 _unexpected __alloca_probe_16 12686->12691 12690 8dea84 12687->12690 12689->12691 12695 8e2b92 12690->12695 12691->12685 12692 8df0e2 ___scrt_uninitialize_crt MultiByteToWideChar 12691->12692 12693 8dfecb 12692->12693 12693->12685 12694 8dfed6 GetStringTypeW 12693->12694 12694->12685 12696 8de408 43 API calls 12695->12696 12697 8e2ba5 12696->12697 12707 8e29a4 12697->12707 12701 8df0f3 MultiByteToWideChar 12700->12701 12701->12686 12704 8dff23 12703->12704 12706 8dff34 12703->12706 12705 8ddd6e ___free_lconv_mon 14 API calls 12704->12705 12704->12706 12705->12706 12706->12684 12708 8e29bf 12707->12708 12709 8df0e2 ___scrt_uninitialize_crt MultiByteToWideChar 12708->12709 12713 8e2a05 12709->12713 12710 8e2b7d 12711 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 12710->12711 12712 8deaa5 12711->12712 12712->12678 12713->12710 12714 8dfae8 15 API calls 12713->12714 12716 8e2a2b __alloca_probe_16 12713->12716 12724 8e2ab1 12713->12724 12714->12716 12715 8dff17 __freea 14 API calls 12715->12710 12717 8df0e2 ___scrt_uninitialize_crt MultiByteToWideChar 12716->12717 12716->12724 12718 8e2a70 12717->12718 12718->12724 12735 8e0616 12718->12735 12721 8e2ada 12723 8e2b65 12721->12723 12726 8dfae8 15 API calls 12721->12726 12728 8e2aec __alloca_probe_16 12721->12728 12722 8e2aa2 12722->12724 12725 8e0616 6 API calls 12722->12725 12727 8dff17 __freea 14 API calls 12723->12727 12724->12715 12725->12724 12726->12728 12727->12724 12728->12723 12729 8e0616 6 API calls 12728->12729 12730 8e2b2f 12729->12730 12730->12723 12741 8df15e 12730->12741 12732 8e2b49 12732->12723 12733 8e2b52 12732->12733 12734 8dff17 __freea 14 API calls 12733->12734 12734->12724 12744 8e02eb 12735->12744 12739 8e0667 LCMapStringW 12740 8e0627 12739->12740 12740->12721 12740->12722 12740->12724 12743 8df175 WideCharToMultiByte 12741->12743 12743->12732 12745 8e03ea __dosmaperr 5 API calls 12744->12745 12746 8e0301 12745->12746 12746->12740 12747 8e0673 12746->12747 12750 8e0305 12747->12750 12749 8e067e 12749->12739 12751 8e03ea __dosmaperr 5 API calls 12750->12751 12752 8e031b 12751->12752 12752->12749 12753->12616 12764 8defe0 12754->12764 12756 8de869 12757 8defe0 43 API calls 12756->12757 12758 8de888 12757->12758 12759 8de81d 12758->12759 12760 8ddd6e ___free_lconv_mon 14 API calls 12758->12760 12761 8de83b 12759->12761 12760->12759 12778 8df375 LeaveCriticalSection 12761->12778 12763 8de829 12763->12408 12765 8deff1 12764->12765 12774 8defed __InternalCxxFrameHandler 12764->12774 12766 8deff8 12765->12766 12770 8df00b _unexpected 12765->12770 12767 8ddcfe __dosmaperr 14 API calls 12766->12767 12768 8deffd 12767->12768 12769 8ddc00 ___std_exception_copy 43 API calls 12768->12769 12769->12774 12771 8df039 12770->12771 12772 8df042 12770->12772 12770->12774 12773 8ddcfe __dosmaperr 14 API calls 12771->12773 12772->12774 12776 8ddcfe __dosmaperr 14 API calls 12772->12776 12775 8df03e 12773->12775 12774->12756 12777 8ddc00 ___std_exception_copy 43 API calls 12775->12777 12776->12775 12777->12774 12778->12763 12780 8de408 43 API calls 12779->12780 12781 8df074 12780->12781 12781->12189 12783 8d7760 _unexpected 12782->12783 12784 8d1483 VerSetConditionMask VerSetConditionMask VerSetConditionMask VerifyVersionInfoW 12783->12784 12785 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 12784->12785 12786 8d14e6 12785->12786 12786->12194 12786->12200 12788 8d2b50 68 API calls 12787->12788 12789 8d2625 12788->12789 12966 8d2f5f 12789->12966 12791 8d2635 _unexpected 12792 8d26d9 12791->12792 12794 8d264f GetModuleFileNameW 12791->12794 12793 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 12792->12793 12795 8d26e7 12793->12795 12794->12792 12796 8d266a 12794->12796 12800 8d26e9 12795->12800 12796->12792 12797 8d266e RegCreateKeyExW 12796->12797 12797->12792 12798 8d2699 lstrlenW RegSetValueExW 12797->12798 12798->12792 12799 8d26cd RegCloseKey 12798->12799 12799->12792 12801 8d7760 _unexpected 12800->12801 12802 8d2713 GetModuleFileNameW 12801->12802 12803 8d275f 12802->12803 12804 8d272f 12802->12804 12806 8d2ba0 66 API calls 12803->12806 12804->12803 12805 8d2733 12804->12805 12807 8d2ba0 66 API calls 12805->12807 12814 8d275d 12806->12814 12808 8d2745 12807->12808 12973 8d4b06 12808->12973 12809 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 12811 8d2779 12809->12811 12815 8d2b50 12811->12815 12813 8d2f5f RtlFreeHeap 12813->12814 12814->12809 13040 8d11d5 12815->13040 12818 8d2b95 12820 8d103b RaiseException 12818->12820 12819 8d2b61 12822 8d2b86 12819->12822 12823 8d2b79 12819->12823 12821 8d2b9f 12820->12821 13055 8d2dc4 12822->13055 13064 8d29de 12823->13064 12826 8d27f9 12827 8d2bff 12826->12827 12828 8d11d5 58 API calls 12827->12828 12830 8d2c07 12828->12830 12829 8d2802 12833 8d2ba0 12829->12833 12830->12829 12831 8d103b RaiseException 12830->12831 12832 8d2c25 12831->12832 12834 8d11d5 58 API calls 12833->12834 12835 8d2bac 12834->12835 12836 8d2bf4 12835->12836 12839 8d2bb2 12835->12839 12837 8d103b RaiseException 12836->12837 12838 8d2bfe 12837->12838 12840 8d29de 51 API calls 12839->12840 12841 8d2bd6 12839->12841 12840->12841 12841->12212 13223 8d1edd IsUserAnAdmin 12842->13223 12844 8d195d 12849 8d1961 12844->12849 13247 8d2024 12844->13247 12851 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 12849->12851 12852 8d1cdd 12851->12852 12915 8d18b8 12852->12915 12854 8d198e 12855 8d1ad5 12854->12855 12856 8d19f1 12854->12856 13272 8d3555 12854->13272 13372 8d3520 12855->13372 13299 8d2132 12856->13299 12861 8d2f7a 14 API calls 12862 8d1a20 12861->12862 12863 8d2c26 RaiseException 12862->12863 12864 8d1a48 PathQuoteSpacesW 12863->12864 13317 8d28b9 12864->13317 12866 8d1a60 _unexpected 12867 8d1a73 GetModuleFileNameW 12866->12867 12868 8d1a8a 12867->12868 12869 8d1a99 12867->12869 12868->12869 13321 8d1570 12868->13321 12871 8d1c0e 12869->12871 12872 8d1aba 12869->12872 12873 8d14eb 63 API calls 12871->12873 12874 8d1abe 12872->12874 12875 8d1ada 12872->12875 12877 8d1c20 12873->12877 12878 8d254e 74 API calls 12874->12878 12876 8d2b50 68 API calls 12875->12876 12880 8d1ae6 12876->12880 13423 8d1cdf 12877->13423 12879 8d1aca 12878->12879 12882 8d2f5f RtlFreeHeap 12879->12882 12883 8d2bff 59 API calls 12880->12883 12882->12855 12885 8d1af1 12883->12885 12884 8d1c06 13341 8d1db4 12884->13341 13332 8d2aa0 12885->13332 12888 8d1c8d 13356 8d37e2 12888->13356 12891 8d1ca2 12896 8d2f5f RtlFreeHeap 12891->12896 12893 8d2b50 68 API calls 12895 8d1c51 12893->12895 12894 8d2f5f RtlFreeHeap 12897 8d1b42 12894->12897 12900 8d14eb 63 API calls 12895->12900 12896->12855 12898 8d1bcd 12897->12898 12899 8d1b4a 12897->12899 12901 8d14eb 63 API calls 12898->12901 13392 8d2a5b 12899->13392 12904 8d1c7f 12900->12904 12905 8d1bcb 12901->12905 12907 8d2f5f RtlFreeHeap 12904->12907 12908 8d2f5f RtlFreeHeap 12905->12908 12907->12888 12909 8d1bfb 12908->12909 12910 8d2f5f RtlFreeHeap 12909->12910 12910->12884 12911 8d1b7e _strncpy 13410 8d14eb 12911->13410 12914 8d2f5f RtlFreeHeap 12914->12905 12916 8d18c9 12915->12916 12926 8d18ff 12915->12926 12917 8d18e6 12916->12917 12918 8d28df RaiseException 12916->12918 12919 8d2904 15 API calls 12917->12919 12921 8d18d8 DeleteFileW 12918->12921 12922 8d18ed RemoveDirectoryW 12919->12922 12920 8d2f5f RtlFreeHeap 12923 8d190c 12920->12923 12921->12916 12921->12917 12924 8d2c62 44 API calls 12922->12924 12925 8d2f5f RtlFreeHeap 12923->12925 12924->12926 12927 8d1913 12925->12927 12926->12920 12928 8d2904 15 API calls 12927->12928 12929 8d191a 12928->12929 12930 8d2f5f RtlFreeHeap 12929->12930 12931 8d1922 12930->12931 12932 8d2f5f RtlFreeHeap 12931->12932 12933 8d192a 12932->12933 12934 8d29ca 12935 8d2857 12934->12935 12936 8d29d2 12934->12936 12935->12232 12936->12935 12937 8d29d7 CoUninitialize 12936->12937 12937->12935 12939 8d2bff 59 API calls 12938->12939 12940 8d2560 12939->12940 12941 8d256d 12940->12941 12942 8d257c 12940->12942 12943 8d29de 51 API calls 12941->12943 12944 8d2bff 59 API calls 12942->12944 12945 8d257a 12943->12945 12946 8d2584 12944->12946 12949 8d2bff 59 API calls 12945->12949 12947 8d29de 51 API calls 12946->12947 12948 8d258d 12947->12948 13936 8d324d 12948->13936 12950 8d25b1 12949->12950 12952 8d2bff 59 API calls 12950->12952 12954 8d25b9 12952->12954 12953 8d259e 12955 8d2f5f RtlFreeHeap 12953->12955 12956 8d29de 51 API calls 12954->12956 12955->12945 12957 8d25c2 12956->12957 12958 8d324d 73 API calls 12957->12958 12959 8d25d3 12958->12959 12960 8d2f5f RtlFreeHeap 12959->12960 12961 8d25de MessageBoxW 12960->12961 12962 8d2f5f RtlFreeHeap 12961->12962 12963 8d25f6 12962->12963 12964 8d2f5f RtlFreeHeap 12963->12964 12965 8d25fe 12964->12965 12965->12934 12967 8d2f79 12966->12967 12968 8d2f71 12966->12968 12967->12791 12970 8d114d 12968->12970 12971 8d1164 12970->12971 12972 8d1156 RtlFreeHeap 12970->12972 12971->12967 12972->12971 12974 8d2bff 59 API calls 12973->12974 12975 8d4b19 12974->12975 12995 8d3a75 lstrcpynW PathStripPathW PathRemoveExtensionW lstrlenW 12975->12995 12978 8d4b70 12979 8d2ba0 66 API calls 12978->12979 12981 8d4b69 12979->12981 12983 8d2f5f RtlFreeHeap 12981->12983 12986 8d2752 12983->12986 12986->12813 12996 8d3ad5 lstrlenW 12995->12996 12997 8d3ae7 12995->12997 12998 8d3b26 12996->12998 12997->12996 13000 8d3b1a 12997->13000 13001 8d3b76 12997->13001 12999 8d3b39 12998->12999 13002 8d3b3b lstrlenW 12998->13002 13015 8d3939 lstrlenW 12999->13015 13000->12996 13025 8d72b2 13001->13025 13002->12999 13006 8d3b51 13007 8d3b62 13006->13007 13019 8d39c5 lstrlenW 13006->13019 13009 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 13007->13009 13010 8d3b74 13009->13010 13010->12978 13011 8d2c26 13010->13011 13012 8d2c57 13011->13012 13033 8d103b 13012->13033 13016 8d3952 13015->13016 13017 8d3963 lstrlenW 13016->13017 13018 8d396e 13016->13018 13017->13018 13018->13006 13020 8d39e3 13019->13020 13021 8d3a12 lstrlenW 13020->13021 13024 8d39fa 13020->13024 13023 8d3a26 13021->13023 13021->13024 13022 8d3a47 lstrlenW 13022->13023 13022->13024 13023->13022 13023->13024 13024->13007 13028 8d72be IsProcessorFeaturePresent 13025->13028 13029 8d72d3 13028->13029 13032 8d7190 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 13029->13032 13031 8d3b7b 13032->13031 13039 8d1026 RaiseException 13033->13039 13035 8d107a 13036 8d105b 13036->13035 13037 8d103b RaiseException 13036->13037 13038 8d1096 13037->13038 13039->13036 13041 8d11ec 13040->13041 13042 8d1203 13040->13042 13045 8e86c5 6 API calls 13041->13045 13054 8d11fe 13041->13054 13073 8e86c5 EnterCriticalSection 13042->13073 13044 8d120e 13044->13041 13047 8d1218 GetProcessHeap 13044->13047 13046 8d1253 13045->13046 13049 8d6be1 46 API calls 13046->13049 13046->13054 13078 8d6be1 13047->13078 13051 8d12a0 13049->13051 13053 8e867b __Init_thread_footer 5 API calls 13051->13053 13053->13054 13054->12818 13054->12819 13056 8d2e0d 13055->13056 13057 8d2dd1 MultiByteToWideChar 13055->13057 13180 8d2c62 13056->13180 13057->13056 13059 8d2dea 13057->13059 13061 8d2c26 RaiseException 13059->13061 13060 8d2e0b 13060->12826 13062 8d2df2 MultiByteToWideChar 13061->13062 13154 8d2e7d 13062->13154 13184 8e805d EnterCriticalSection 13064->13184 13066 8d29f3 13067 8d2a09 FindResourceExW 13066->13067 13068 8e805d 3 API calls 13066->13068 13070 8d2a41 13066->13070 13072 8d2a50 13066->13072 13189 8d10bf LoadResource 13066->13189 13067->13066 13068->13066 13070->13072 13193 8d2d36 FindResourceW 13070->13193 13072->12826 13074 8e86d9 13073->13074 13075 8e86de LeaveCriticalSection 13074->13075 13086 8e874d 13074->13086 13075->13044 13091 8d6bb4 13078->13091 13081 8e867b EnterCriticalSection LeaveCriticalSection 13082 8e8717 13081->13082 13083 8e8722 RtlWakeAllConditionVariable 13082->13083 13084 8e8733 SetEvent ResetEvent 13082->13084 13083->13041 13084->13041 13087 8e875b SleepConditionVariableCS 13086->13087 13088 8e8774 LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 13086->13088 13089 8e8798 13087->13089 13088->13089 13089->13074 13092 8d6bca 13091->13092 13093 8d6bc3 13091->13093 13100 8da5f5 13092->13100 13097 8da578 13093->13097 13096 8d123e 13096->13081 13098 8da5f5 46 API calls 13097->13098 13099 8da58a 13098->13099 13099->13096 13103 8da341 13100->13103 13104 8da34d CallCatchBlock 13103->13104 13111 8df32d EnterCriticalSection 13104->13111 13106 8da35b 13112 8da39c 13106->13112 13108 8da368 13122 8da390 13108->13122 13111->13106 13114 8da3b7 13112->13114 13120 8da42a __dosmaperr 13112->13120 13113 8da40a 13115 8e06f9 46 API calls 13113->13115 13113->13120 13114->13113 13114->13120 13125 8e06f9 13114->13125 13117 8da420 13115->13117 13119 8ddd6e ___free_lconv_mon 14 API calls 13117->13119 13118 8da400 13121 8ddd6e ___free_lconv_mon 14 API calls 13118->13121 13119->13120 13120->13108 13121->13113 13153 8df375 LeaveCriticalSection 13122->13153 13124 8da379 13124->13096 13126 8e0706 13125->13126 13127 8e0721 13125->13127 13126->13127 13129 8e0712 13126->13129 13128 8e0730 13127->13128 13146 8e2cb5 13127->13146 13134 8e2ce8 13128->13134 13131 8ddcfe __dosmaperr 14 API calls 13129->13131 13133 8e0717 _unexpected 13131->13133 13133->13118 13135 8e2cf5 13134->13135 13136 8e2d00 13134->13136 13137 8dfae8 15 API calls 13135->13137 13138 8e2d08 13136->13138 13144 8e2d11 __dosmaperr 13136->13144 13142 8e2cfd 13137->13142 13139 8ddd6e ___free_lconv_mon 14 API calls 13138->13139 13139->13142 13140 8e2d3b RtlReAllocateHeap 13140->13142 13140->13144 13141 8e2d16 13143 8ddcfe __dosmaperr 14 API calls 13141->13143 13142->13133 13143->13142 13144->13140 13144->13141 13145 8e0829 __dosmaperr EnterCriticalSection LeaveCriticalSection 13144->13145 13145->13144 13147 8e2cd5 HeapSize 13146->13147 13148 8e2cc0 13146->13148 13147->13128 13149 8ddcfe __dosmaperr 14 API calls 13148->13149 13150 8e2cc5 13149->13150 13151 8ddc00 ___std_exception_copy 43 API calls 13150->13151 13152 8e2cd0 13151->13152 13152->13128 13153->13124 13155 8d2e87 13154->13155 13156 8d2e8e 13155->13156 13157 8d103b RaiseException 13155->13157 13156->13060 13158 8d2ea7 13157->13158 13159 8d2eb6 13158->13159 13160 8d2ec0 13158->13160 13161 8d2c62 44 API calls 13159->13161 13162 8d2eca 13160->13162 13163 8d2f54 13160->13163 13165 8d2ebb 13161->13165 13166 8d2c26 RaiseException 13162->13166 13164 8d103b RaiseException 13163->13164 13167 8d2f5e 13164->13167 13165->13060 13168 8d2ee2 13166->13168 13169 8d2f3a 13168->13169 13170 8d2ef0 13168->13170 13171 8d3024 14 API calls 13169->13171 13173 8d2f01 13170->13173 13175 8d2f17 13170->13175 13177 8d2f11 __InternalCxxFrameHandler 13170->13177 13171->13177 13172 8d2e7d 44 API calls 13172->13165 13174 8ddcfe __dosmaperr 14 API calls 13173->13174 13176 8d2f06 13174->13176 13175->13177 13178 8ddcfe __dosmaperr 14 API calls 13175->13178 13179 8ddc00 ___std_exception_copy 43 API calls 13176->13179 13177->13172 13178->13176 13179->13177 13181 8d2c85 13180->13181 13182 8d2c74 13180->13182 13181->13060 13182->13181 13183 8d2e7d 44 API calls 13182->13183 13183->13181 13185 8e807f LeaveCriticalSection 13184->13185 13187 8e8076 13184->13187 13185->13066 13187->13185 13203 8d28df 13187->13203 13190 8d10f5 13189->13190 13191 8d10d5 LockResource 13189->13191 13190->13066 13191->13190 13192 8d10e2 SizeofResource 13191->13192 13192->13190 13194 8d2d97 13193->13194 13195 8d2d57 13193->13195 13194->13072 13196 8d10bf 3 API calls 13195->13196 13197 8d2d64 13196->13197 13197->13194 13198 8d2c26 RaiseException 13197->13198 13199 8d2d77 13198->13199 13209 8e98b7 13199->13209 13201 8d2d86 13202 8d2e7d 44 API calls 13201->13202 13202->13194 13204 8d28e9 13203->13204 13205 8d28ee 13204->13205 13208 8d1026 RaiseException 13204->13208 13205->13185 13207 8d2903 13208->13207 13210 8e98c8 13209->13210 13213 8e98c4 __InternalCxxFrameHandler 13209->13213 13211 8e98cf 13210->13211 13215 8e98e2 _wmemset 13210->13215 13212 8ddcfe __dosmaperr 14 API calls 13211->13212 13214 8e98d4 13212->13214 13213->13201 13216 8ddc00 ___std_exception_copy 43 API calls 13214->13216 13215->13213 13217 8e9913 13215->13217 13219 8e991c 13215->13219 13216->13213 13218 8ddcfe __dosmaperr 14 API calls 13217->13218 13220 8e9918 13218->13220 13219->13213 13221 8ddcfe __dosmaperr 14 API calls 13219->13221 13222 8ddc00 ___std_exception_copy 43 API calls 13220->13222 13221->13220 13222->13213 13224 8d1ef7 13223->13224 13234 8d1952 13223->13234 13225 8d2bff 59 API calls 13224->13225 13226 8d1f01 13225->13226 13227 8d2c26 RaiseException 13226->13227 13228 8d1f17 SHGetFolderPathW 13227->13228 13229 8d28b9 44 API calls 13228->13229 13230 8d1f35 13229->13230 13231 8d1f9e 13230->13231 13233 8d2ba0 66 API calls 13230->13233 13232 8d2f5f RtlFreeHeap 13231->13232 13232->13234 13235 8d1f44 13233->13235 13234->12844 13379 8d1fad 13234->13379 13440 8d2860 13235->13440 13238 8d1f6c 13241 8d2860 2 API calls 13238->13241 13239 8d1f5f GetLastError 13239->13238 13240 8d1f94 13239->13240 13242 8d2f5f RtlFreeHeap 13240->13242 13243 8d1f79 13241->13243 13242->13231 13447 8d1e34 CreateDirectoryW 13243->13447 13248 8d7760 _unexpected 13247->13248 13249 8d2053 GetTempFileNameW 13248->13249 13250 8d2074 13249->13250 13251 8d2121 13249->13251 13253 8d2ba0 66 API calls 13250->13253 13252 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 13251->13252 13254 8d1970 13252->13254 13255 8d2086 13253->13255 13254->12849 13268 8d2f7a 13254->13268 13466 8d293d 13255->13466 13258 8d2f5f RtlFreeHeap 13259 8d20a0 FindResourceW 13258->13259 13259->13251 13260 8d20b4 LoadResource 13259->13260 13260->13251 13261 8d20c1 LockResource 13260->13261 13261->13251 13262 8d20ce CreateFileW 13261->13262 13262->13251 13263 8d20ef SizeofResource 13262->13263 13474 8d2369 13263->13474 13266 8d2108 SetFilePointerEx 13266->13251 13267 8d2117 CloseHandle 13266->13267 13267->13251 13269 8d2f85 13268->13269 13270 8d3024 14 API calls 13269->13270 13271 8d2f93 13269->13271 13270->13271 13271->12854 13505 8e84f0 13272->13505 13275 8d35cf 13276 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 13275->13276 13277 8d3777 13276->13277 13277->12854 13278 8d35a5 13278->13275 13279 8d2f7a 14 API calls 13278->13279 13280 8d35ff 13279->13280 13507 8d377b 13280->13507 13283 8d377b 69 API calls 13284 8d362a CreateFileW 13283->13284 13285 8d3753 13284->13285 13286 8d3654 13284->13286 13287 8d2f5f RtlFreeHeap 13285->13287 13523 8e9ad4 13286->13523 13287->13275 13290 8d3706 FindCloseChangeNotification 13292 8d371a 13290->13292 13293 8d372e 13290->13293 13291 8d3691 13294 8d36a8 ReadFile 13291->13294 13296 8d36fe 13291->13296 13292->13293 13298 8d293d 15 API calls 13292->13298 13293->13285 13297 8d3747 SetFilePointer 13293->13297 13295 8d36c5 WriteFile 13294->13295 13294->13296 13295->13291 13295->13296 13296->13290 13297->13285 13298->13293 13300 8d2bff 59 API calls 13299->13300 13301 8d2145 13300->13301 13302 8d2c26 RaiseException 13301->13302 13303 8d215c GetModuleFileNameW 13302->13303 13304 8d28b9 44 API calls 13303->13304 13305 8d2174 13304->13305 13306 8d21bf 13305->13306 13309 8d2ba0 66 API calls 13305->13309 13307 8d2f5f RtlFreeHeap 13306->13307 13308 8d19f8 13307->13308 13308->12855 13308->12861 13310 8d218b 13309->13310 13311 8d2860 2 API calls 13310->13311 13312 8d2198 CopyFileW 13311->13312 13313 8d21a9 13312->13313 13314 8d21b5 13312->13314 13315 8d293d 15 API calls 13313->13315 13316 8d2f5f RtlFreeHeap 13314->13316 13315->13314 13316->13306 13319 8d28c4 13317->13319 13318 8d2e7d 44 API calls 13320 8d28dd 13318->13320 13319->13318 13320->12866 13322 8d157e 13321->13322 13323 8d157a 13321->13323 13606 8d344a 13322->13606 13323->12869 13325 8d18a2 13326 8d34e2 3 API calls 13325->13326 13328 8d18b3 13326->13328 13328->12869 13329 8d15a4 13329->13325 13330 8e879b 3 API calls 13329->13330 13331 8d1721 __InternalCxxFrameHandler 13329->13331 13330->13331 13616 8d34e2 13331->13616 13333 8d2aaf 13332->13333 13334 8d2acc 13333->13334 13335 8d2aba 13333->13335 13337 8d2da5 58 API calls 13334->13337 13336 8d2f7a 14 API calls 13335->13336 13338 8d1b2c lstrcmpiW 13336->13338 13339 8d2ad3 13337->13339 13338->12894 13623 8d2e1c 13339->13623 13342 8d2bff 59 API calls 13341->13342 13343 8d1dc4 13342->13343 13344 8d14eb 63 API calls 13343->13344 13345 8d1dd7 13344->13345 13346 8d2aa0 59 API calls 13345->13346 13347 8d1dee lstrcmpiW 13346->13347 13348 8d2f5f RtlFreeHeap 13347->13348 13349 8d1e01 13348->13349 13350 8d1e1d 13349->13350 13351 8d2c26 RaiseException 13349->13351 13353 8d2f5f RtlFreeHeap 13350->13353 13352 8d1e15 13351->13352 13354 8d2e7d 44 API calls 13352->13354 13355 8d1c3d 13353->13355 13354->13350 13355->12888 13355->12893 13357 8d2f7a 14 API calls 13356->13357 13358 8d37f8 _unexpected 13357->13358 13359 8d380c GetStartupInfoW 13358->13359 13360 8d3835 13359->13360 13361 8d3843 CreateProcessW 13359->13361 13362 8d30d0 15 API calls 13360->13362 13363 8d386e WaitForSingleObject 13361->13363 13364 8d3861 GetLastError 13361->13364 13365 8d3840 13362->13365 13367 8d3891 13363->13367 13368 8d3880 GetExitCodeProcess 13363->13368 13366 8d38a4 13364->13366 13365->13361 13370 8d2f5f RtlFreeHeap 13366->13370 13369 8d3894 CloseHandle CloseHandle 13367->13369 13368->13369 13369->13366 13371 8d38ac 13370->13371 13371->12891 13373 8d352c 13372->13373 13374 8d3543 13372->13374 13376 8d28df RaiseException 13373->13376 13633 8d2904 13374->13633 13377 8d3535 DeleteFileW 13376->13377 13377->13373 13377->13374 13380 8d2bff 59 API calls 13379->13380 13381 8d1fc0 13380->13381 13382 8d2c26 RaiseException 13381->13382 13383 8d1fd7 GetTempPathW 13382->13383 13384 8d28b9 44 API calls 13383->13384 13385 8d1fec 13384->13385 13387 8d1e34 65 API calls 13385->13387 13391 8d200f 13385->13391 13386 8d2f5f RtlFreeHeap 13389 8d201d 13386->13389 13388 8d1fff 13387->13388 13390 8d2aef 14 API calls 13388->13390 13388->13391 13389->12844 13390->13391 13391->13386 13393 8d2a69 13392->13393 13394 8d2a84 13393->13394 13395 8d2a72 13393->13395 13397 8d2da5 58 API calls 13394->13397 13396 8d2f7a 14 API calls 13395->13396 13398 8d1b6c 13396->13398 13399 8d2a8b 13397->13399 13401 8e879b 13398->13401 13400 8d2e1c 44 API calls 13399->13400 13400->13398 13402 8e87a4 ___std_exception_copy 13401->13402 13403 8e87c3 13402->13403 13404 8e0829 __dosmaperr 2 API calls 13402->13404 13406 8e87c5 13402->13406 13403->12911 13404->13402 13405 8e8856 13407 8d9616 CallUnexpected RaiseException 13405->13407 13406->13405 13642 8d9616 13406->13642 13409 8e8873 13407->13409 13411 8d2bff 59 API calls 13410->13411 13412 8d14fb 13411->13412 13413 8d2c26 RaiseException 13412->13413 13414 8d1514 13413->13414 13645 8dcfd8 13414->13645 13417 8d28b9 44 API calls 13418 8d1558 13417->13418 13419 8d2ca8 44 API calls 13418->13419 13420 8d1564 13419->13420 13421 8d2f5f RtlFreeHeap 13420->13421 13422 8d156c 13421->13422 13422->12914 13424 8d2bff 59 API calls 13423->13424 13425 8d1d05 13424->13425 13426 8d14eb 63 API calls 13425->13426 13427 8d1d1b 13426->13427 13428 8d2a5b 59 API calls 13427->13428 13429 8d1d36 13428->13429 13430 8d2f5f RtlFreeHeap 13429->13430 13431 8d1d4d _unexpected 13430->13431 13432 8d1d95 13431->13432 13434 8d1d63 GetModuleFileNameW 13431->13434 13433 8d2f5f RtlFreeHeap 13432->13433 13435 8d1da3 13433->13435 13434->13432 13436 8d1d7f 13434->13436 13437 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 13435->13437 13436->13432 13439 8d14eb 63 API calls 13436->13439 13438 8d1db0 13437->13438 13438->12884 13439->13432 13441 8d2c26 RaiseException 13440->13441 13442 8d2871 PathAppendW 13441->13442 13444 8d2883 13442->13444 13443 8d1f51 CreateDirectoryW 13443->13238 13443->13239 13444->13443 13445 8d103b RaiseException 13444->13445 13446 8d28b8 13445->13446 13448 8d1e51 GetLastError 13447->13448 13449 8d1e62 13447->13449 13448->13449 13450 8d1e5e 13448->13450 13451 8d2bff 59 API calls 13449->13451 13450->13240 13462 8d2aef 13450->13462 13452 8d1e6a 13451->13452 13453 8d2c26 RaiseException 13452->13453 13454 8d1e80 GetTempFileNameW 13453->13454 13455 8d28b9 44 API calls 13454->13455 13456 8d1e9c 13455->13456 13457 8d1ea5 DeleteFileW CreateDirectoryW 13456->13457 13461 8d1ecb 13456->13461 13459 8d1ebc 13457->13459 13457->13461 13458 8d2f5f RtlFreeHeap 13458->13450 13460 8d2aef 14 API calls 13459->13460 13460->13461 13461->13458 13463 8d2b07 13462->13463 13465 8d2b1b 13462->13465 13464 8d2f7a 14 API calls 13463->13464 13463->13465 13464->13465 13465->13240 13467 8d294f 13466->13467 13473 8d295f 13466->13473 13469 8d29bf 13467->13469 13467->13473 13468 8d2095 13468->13258 13471 8d103b RaiseException 13469->13471 13470 8d2f7a 14 API calls 13470->13468 13472 8d29c9 13471->13472 13473->13468 13473->13470 13475 8d2399 13474->13475 13486 8d2391 13474->13486 13488 8d6440 13475->13488 13478 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 13480 8d2103 13478->13480 13479 8e879b 3 API calls 13481 8d2400 13479->13481 13480->13266 13480->13267 13482 8e879b 3 API calls 13481->13482 13481->13486 13483 8d24b8 13482->13483 13494 8d64b6 13483->13494 13486->13478 13487 8d24ff WriteFile 13487->13486 13489 8d6454 13488->13489 13490 8d23c7 13489->13490 13498 8d63ed 13489->13498 13490->13479 13497 8d651a 13494->13497 13495 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 13496 8d24ed 13495->13496 13496->13486 13496->13487 13497->13495 13499 8d640c 13498->13499 13500 8d6427 13499->13500 13501 8d234d 3 API calls 13499->13501 13500->13490 13502 8d234d 13500->13502 13501->13500 13503 8e879b 3 API calls 13502->13503 13504 8d2358 13503->13504 13504->13490 13506 8d3562 ReadFile 13505->13506 13506->13275 13506->13278 13529 8d2da5 13507->13529 13510 8d378d 13514 8d37b4 13510->13514 13516 8d37a6 13510->13516 13511 8d37d7 13512 8d103b RaiseException 13511->13512 13513 8d37e1 13512->13513 13515 8d2dc4 46 API calls 13514->13515 13517 8d37b2 13515->13517 13518 8d29de 51 API calls 13516->13518 13533 8d2ca8 13517->13533 13518->13517 13521 8d2f5f RtlFreeHeap 13522 8d3618 13521->13522 13522->13283 13524 8e9ae7 ___std_exception_copy 13523->13524 13545 8dd05a 13524->13545 13526 8e9b08 13527 8dbce0 ___std_exception_copy 43 API calls 13526->13527 13528 8d3663 SetFilePointer 13527->13528 13528->13290 13528->13291 13530 8d2dae 13529->13530 13531 8d11d5 58 API calls 13530->13531 13532 8d2dbc 13530->13532 13531->13532 13532->13510 13532->13511 13534 8d2d2b 13533->13534 13538 8d2cce 13533->13538 13535 8d103b RaiseException 13534->13535 13536 8d2d35 13535->13536 13537 8d2cf4 13539 8d2c26 RaiseException 13537->13539 13538->13534 13538->13537 13540 8d2d01 13539->13540 13541 8d3024 14 API calls 13540->13541 13542 8d2d17 13541->13542 13543 8d2e7d 44 API calls 13542->13543 13544 8d2d24 13543->13544 13544->13521 13559 8dcf1b 13545->13559 13547 8dd0b4 13553 8dd0d8 13547->13553 13566 8dcec0 13547->13566 13548 8dd06c 13548->13547 13549 8dd081 13548->13549 13558 8dd09c 13548->13558 13550 8ddb83 ___std_exception_copy 29 API calls 13549->13550 13550->13558 13555 8dd0fc 13553->13555 13573 8dd2a1 13553->13573 13554 8dd184 13556 8dce69 43 API calls 13554->13556 13555->13554 13580 8dce69 13555->13580 13556->13558 13558->13526 13560 8dcf20 13559->13560 13561 8dcf33 13559->13561 13562 8ddcfe __dosmaperr 14 API calls 13560->13562 13561->13548 13563 8dcf25 13562->13563 13564 8ddc00 ___std_exception_copy 43 API calls 13563->13564 13565 8dcf30 13564->13565 13565->13548 13567 8dbee0 ___std_exception_copy 43 API calls 13566->13567 13568 8dced0 13567->13568 13586 8e14f9 13568->13586 13574 8dd2ad 13573->13574 13575 8dd2c3 13573->13575 13594 8dfac4 13574->13594 13577 8dd2d3 13575->13577 13599 8e2241 13575->13599 13577->13553 13578 8dd2b8 13578->13553 13581 8dce8e 13580->13581 13582 8dce7a 13580->13582 13581->13554 13582->13581 13583 8ddcfe __dosmaperr 14 API calls 13582->13583 13584 8dce83 13583->13584 13585 8ddc00 ___std_exception_copy 43 API calls 13584->13585 13585->13581 13587 8dceed 13586->13587 13588 8e1510 13586->13588 13590 8e1557 13587->13590 13588->13587 13589 8e0200 ___scrt_uninitialize_crt 43 API calls 13588->13589 13589->13587 13591 8e156e 13590->13591 13592 8dcefa 13590->13592 13591->13592 13593 8dedc5 ___scrt_uninitialize_crt 43 API calls 13591->13593 13592->13553 13593->13592 13595 8dd6f0 _unexpected 43 API calls 13594->13595 13596 8dfacf 13595->13596 13597 8e14cc 43 API calls 13596->13597 13598 8dfadf 13597->13598 13598->13578 13600 8de408 43 API calls 13599->13600 13601 8e225e 13600->13601 13602 8dfe0e 46 API calls 13601->13602 13605 8e226e 13601->13605 13602->13605 13603 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 13604 8e230a 13603->13604 13604->13577 13605->13603 13607 8d34e2 3 API calls 13606->13607 13608 8d3459 CreateFileW 13607->13608 13609 8d347c CreateFileMappingW 13608->13609 13610 8d34c0 13608->13610 13611 8d3490 MapViewOfFile 13609->13611 13612 8d34d3 13609->13612 13610->13329 13614 8d34ca CloseHandle 13611->13614 13615 8d34a5 VirtualQuery 13611->13615 13613 8d34e2 3 API calls 13612->13613 13613->13610 13614->13612 13615->13610 13615->13614 13617 8d34f8 13616->13617 13618 8d34eb UnmapViewOfFile 13616->13618 13619 8d34fe CloseHandle 13617->13619 13620 8d350b 13617->13620 13618->13617 13619->13620 13621 8d351e 13620->13621 13622 8d3511 CloseHandle 13620->13622 13621->13325 13622->13621 13624 8d2e37 13623->13624 13625 8d2e2a 13623->13625 13627 8d103b RaiseException 13624->13627 13625->13624 13626 8d2e3e 13625->13626 13628 8d2e77 13626->13628 13629 8d2e7d 44 API calls 13626->13629 13627->13628 13630 8d2e56 13629->13630 13631 8d3024 14 API calls 13630->13631 13632 8d2e63 13631->13632 13632->13338 13634 8d2930 13633->13634 13635 8d2910 13633->13635 13636 8d2f5f RtlFreeHeap 13635->13636 13638 8d2928 13635->13638 13636->13635 13639 8da800 13638->13639 13640 8ddd6e ___free_lconv_mon 14 API calls 13639->13640 13641 8da818 13640->13641 13641->13634 13643 8d965d RaiseException 13642->13643 13644 8d9630 13642->13644 13643->13405 13644->13643 13646 8dcfec ___std_exception_copy 13645->13646 13651 8daa52 13646->13651 13649 8dbce0 ___std_exception_copy 43 API calls 13650 8d153a 13649->13650 13650->13417 13652 8daa7e 13651->13652 13653 8daaa1 13651->13653 13654 8ddb83 ___std_exception_copy 29 API calls 13652->13654 13653->13652 13657 8daaa9 13653->13657 13655 8daa96 13654->13655 13656 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 13655->13656 13658 8dabd3 13656->13658 13662 8dc206 13657->13662 13658->13649 13675 8dcf36 13662->13675 13665 8dab2a 13672 8dbd1c 13665->13672 13666 8dc229 13667 8ddb83 ___std_exception_copy 29 API calls 13666->13667 13667->13665 13670 8dc253 13670->13665 13679 8dbf3c 13670->13679 13682 8dc446 13670->13682 13723 8dc5d4 13670->13723 13673 8ddd6e ___free_lconv_mon 14 API calls 13672->13673 13674 8dbd2c 13673->13674 13674->13655 13676 8dcf41 13675->13676 13678 8dc21b 13675->13678 13677 8ddb83 ___std_exception_copy 29 API calls 13676->13677 13677->13678 13678->13665 13678->13666 13678->13670 13759 8dae3d 13679->13759 13681 8dbf79 13681->13670 13683 8dc46c 13682->13683 13684 8dc454 13682->13684 13685 8ddb83 ___std_exception_copy 29 API calls 13683->13685 13686 8dc4ad 13683->13686 13684->13686 13687 8dc66e 13684->13687 13688 8dc5fe 13684->13688 13691 8dc4a1 13685->13691 13686->13670 13689 8dc6c1 13687->13689 13690 8dc673 13687->13690 13692 8dc69b 13688->13692 13693 8dc604 13688->13693 13696 8dc625 13689->13696 13697 8dc6ca 13689->13697 13694 8dc6b5 13690->13694 13695 8dc675 13690->13695 13691->13670 13800 8db5ac 13692->13800 13698 8dc64b 13693->13698 13701 8dc60a 13693->13701 13705 8dc640 13693->13705 13817 8dcd8b 13694->13817 13699 8dc6a9 13695->13699 13700 8dc67a 13695->13700 13722 8dc639 13696->13722 13775 8dcda1 13696->13775 13697->13692 13697->13705 13698->13699 13708 8dc655 13698->13708 13718 8dc631 13698->13718 13807 8dcaa3 13699->13807 13700->13692 13706 8dc67f 13700->13706 13701->13699 13701->13708 13711 8dc617 13701->13711 13705->13722 13779 8db72e 13705->13779 13709 8dc684 13706->13709 13710 8dc692 13706->13710 13708->13722 13786 8dcc43 13708->13786 13709->13722 13792 8dcd6e 13709->13792 13796 8dccea 13710->13796 13711->13696 13711->13699 13711->13722 13714 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 13717 8dc9f3 13714->13717 13717->13670 13719 8dcec0 ___scrt_uninitialize_crt 43 API calls 13718->13719 13721 8dc8d7 13718->13721 13718->13722 13719->13721 13721->13722 13820 8e20d2 13721->13820 13722->13714 13724 8dc66e 13723->13724 13725 8dc5fe 13723->13725 13726 8dc6c1 13724->13726 13727 8dc673 13724->13727 13728 8dc69b 13725->13728 13729 8dc604 13725->13729 13732 8dc625 13726->13732 13733 8dc6ca 13726->13733 13730 8dc6b5 13727->13730 13731 8dc675 13727->13731 13741 8db5ac 30 API calls 13728->13741 13734 8dc64b 13729->13734 13739 8dc60a 13729->13739 13740 8dc640 13729->13740 13738 8dcd8b 30 API calls 13730->13738 13736 8dc6a9 13731->13736 13737 8dc67a 13731->13737 13735 8dcda1 43 API calls 13732->13735 13758 8dc639 13732->13758 13733->13728 13733->13740 13734->13736 13744 8dc655 13734->13744 13754 8dc631 13734->13754 13735->13754 13742 8dcaa3 46 API calls 13736->13742 13737->13728 13743 8dc67f 13737->13743 13738->13754 13739->13736 13739->13744 13748 8dc617 13739->13748 13747 8db72e 30 API calls 13740->13747 13740->13758 13741->13754 13742->13754 13745 8dc684 13743->13745 13746 8dc692 13743->13746 13751 8dcc43 44 API calls 13744->13751 13744->13758 13753 8dcd6e 30 API calls 13745->13753 13745->13758 13750 8dccea 29 API calls 13746->13750 13747->13754 13748->13732 13748->13736 13748->13758 13749 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 13752 8dc9f3 13749->13752 13750->13754 13751->13754 13752->13670 13753->13754 13755 8dcec0 ___scrt_uninitialize_crt 43 API calls 13754->13755 13757 8dc8d7 13754->13757 13754->13758 13755->13757 13756 8e20d2 ___scrt_uninitialize_crt 44 API calls 13756->13757 13757->13756 13757->13758 13758->13749 13760 8dcf1b 43 API calls 13759->13760 13762 8dae53 13760->13762 13761 8dae68 13763 8ddb83 ___std_exception_copy 29 API calls 13761->13763 13762->13761 13766 8dae9b 13762->13766 13768 8dae83 13762->13768 13763->13768 13764 8db19a 13765 8dce92 43 API calls 13764->13765 13765->13768 13766->13764 13769 8dce92 13766->13769 13768->13681 13770 8dcebc 13769->13770 13771 8dcea7 13769->13771 13770->13764 13771->13770 13772 8ddcfe __dosmaperr 14 API calls 13771->13772 13773 8dceb1 13772->13773 13774 8ddc00 ___std_exception_copy 43 API calls 13773->13774 13774->13770 13776 8dcdbd 13775->13776 13778 8dcddb 13776->13778 13832 8dce14 13776->13832 13778->13718 13780 8db742 13779->13780 13781 8db764 13780->13781 13783 8db78b 13780->13783 13782 8ddb83 ___std_exception_copy 29 API calls 13781->13782 13785 8db781 13782->13785 13783->13785 13836 8dad21 13783->13836 13785->13718 13787 8dcc6f 13786->13787 13788 8dccac 13787->13788 13789 8dcc8b 13787->13789 13790 8dcec0 ___scrt_uninitialize_crt 43 API calls 13787->13790 13788->13718 13791 8e20d2 ___scrt_uninitialize_crt 44 API calls 13789->13791 13790->13789 13791->13788 13793 8dcd7a 13792->13793 13850 8db42a 13793->13850 13795 8dcd8a 13795->13718 13797 8dccff 13796->13797 13798 8ddb83 ___std_exception_copy 29 API calls 13797->13798 13799 8dcd20 13797->13799 13798->13799 13799->13718 13801 8db5c0 13800->13801 13802 8db5e2 13801->13802 13805 8db609 13801->13805 13803 8ddb83 ___std_exception_copy 29 API calls 13802->13803 13804 8db5ff 13803->13804 13804->13718 13805->13804 13806 8dad21 15 API calls 13805->13806 13806->13804 13808 8dcac4 13807->13808 13857 8daca0 13808->13857 13810 8dcb08 13868 8e1f51 13810->13868 13813 8dcbb5 13815 8dcec0 ___scrt_uninitialize_crt 43 API calls 13813->13815 13816 8dcbf1 13813->13816 13814 8dcec0 ___scrt_uninitialize_crt 43 API calls 13814->13813 13815->13816 13816->13718 13816->13816 13818 8db72e 30 API calls 13817->13818 13819 8dcda0 13818->13819 13819->13718 13822 8e20e6 13820->13822 13830 8e20f6 13820->13830 13821 8e211b 13824 8e214f 13821->13824 13825 8e212c 13821->13825 13822->13821 13823 8dcec0 ___scrt_uninitialize_crt 43 API calls 13822->13823 13822->13830 13823->13821 13827 8e21cb 13824->13827 13828 8e2177 13824->13828 13824->13830 13929 8e570a 13825->13929 13829 8df0e2 ___scrt_uninitialize_crt MultiByteToWideChar 13827->13829 13828->13830 13831 8df0e2 ___scrt_uninitialize_crt MultiByteToWideChar 13828->13831 13829->13830 13830->13721 13831->13830 13833 8dce27 13832->13833 13835 8dce2e 13832->13835 13834 8dcec0 ___scrt_uninitialize_crt 43 API calls 13833->13834 13834->13835 13835->13778 13837 8dad48 13836->13837 13838 8dad36 13836->13838 13837->13838 13839 8dfae8 15 API calls 13837->13839 13838->13785 13840 8dad6d 13839->13840 13841 8dad75 13840->13841 13842 8dad80 13840->13842 13843 8ddd6e ___free_lconv_mon 14 API calls 13841->13843 13847 8dbd36 13842->13847 13843->13838 13846 8ddd6e ___free_lconv_mon 14 API calls 13846->13838 13848 8ddd6e ___free_lconv_mon 14 API calls 13847->13848 13849 8dad8b 13848->13849 13849->13846 13851 8db43e 13850->13851 13852 8db460 13851->13852 13854 8db487 13851->13854 13853 8ddb83 ___std_exception_copy 29 API calls 13852->13853 13856 8db47d 13853->13856 13855 8dad21 15 API calls 13854->13855 13854->13856 13855->13856 13856->13795 13858 8dacc7 13857->13858 13867 8dacb5 13857->13867 13859 8dfae8 15 API calls 13858->13859 13858->13867 13860 8daceb 13859->13860 13861 8dacfe 13860->13861 13862 8dacf3 13860->13862 13864 8dbd36 14 API calls 13861->13864 13863 8ddd6e ___free_lconv_mon 14 API calls 13862->13863 13863->13867 13865 8dad09 13864->13865 13866 8ddd6e ___free_lconv_mon 14 API calls 13865->13866 13866->13867 13867->13810 13869 8e1f86 13868->13869 13871 8e1f62 13868->13871 13869->13871 13872 8e1fb9 13869->13872 13870 8ddb83 ___std_exception_copy 29 API calls 13886 8dcb92 13870->13886 13871->13870 13873 8e2021 13872->13873 13874 8e1ff2 13872->13874 13875 8e204a 13873->13875 13876 8e204f 13873->13876 13887 8e1df5 13874->13887 13879 8e2077 13875->13879 13880 8e20b1 13875->13880 13895 8e168d 13876->13895 13882 8e207c 13879->13882 13883 8e2097 13879->13883 13886->13813 13886->13814 13888 8e1e0b 13887->13888 13889 8e1e16 13887->13889 13888->13886 13890 8da826 ___std_exception_copy 43 API calls 13889->13890 13932 8e633d 13929->13932 13935 8e6368 ___scrt_uninitialize_crt 13932->13935 13933 8d7182 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 13934 8e5725 13933->13934 13934->13830 13935->13933 13937 8d2da5 58 API calls 13936->13937 13938 8d325a 13937->13938 13939 8d32a4 13938->13939 13942 8d29de 51 API calls 13938->13942 13940 8d103b RaiseException 13939->13940 13941 8d32b5 GetLastError SetLastError FormatMessageW 13940->13941 13945 8d32fb GetLastError 13941->13945 13946 8d3305 SetLastError 13941->13946 13943 8d3276 13942->13943 13943->13939 13947 8d3283 13943->13947 13945->13946 13948 8d33c1 13945->13948 13949 8d33aa 13946->13949 13950 8d3315 13946->13950 13954 8d2f5f RtlFreeHeap 13947->13954 13951 8d2c62 44 API calls 13949->13951 13950->13949 13953 8d3326 13950->13953 13952 8d33b1 LocalFree 13951->13952 13952->12953 13955 8d2c26 RaiseException 13953->13955 13956 8d32a2 13954->13956 13957 8d333d 13955->13957 13956->12953 13958 8d334b 13957->13958 13959 8d3393 13957->13959 13961 8d335c 13958->13961 13965 8d3372 13958->13965 13969 8d336c __InternalCxxFrameHandler 13958->13969 13960 8d3024 14 API calls 13959->13960 13960->13969 13963 8ddcfe __dosmaperr 14 API calls 13961->13963 13962 8d2e7d 44 API calls 13964 8d33a8 13962->13964 13967 8d3361 13963->13967 13964->13952 13966 8ddcfe __dosmaperr 14 API calls 13965->13966 13965->13969 13966->13967 13968 8ddc00 ___std_exception_copy 43 API calls 13967->13968 13968->13969 13969->13962 13971 8d9f9d 13970->13971 13972 8d9f8b 13970->13972 13982 8d9e26 13971->13982 13974 8d6e57 _unexpected GetModuleHandleW 13972->13974 13976 8d9f90 13974->13976 13976->13971 13997 8da048 GetModuleHandleExW 13976->13997 13977 8d6992 13977->12247 13983 8d9e32 CallCatchBlock 13982->13983 14003 8df32d EnterCriticalSection 13983->14003 13985 8d9e3c 14004 8d9e73 13985->14004 13987 8d9e49 14008 8d9e67 13987->14008 13990 8d9ff5 14033 8da026 13990->14033 13993 8da013 13995 8da048 _unexpected 3 API calls 13993->13995 13994 8da003 GetCurrentProcess TerminateProcess 13994->13993 13996 8da01b ExitProcess 13995->13996 13998 8da0a8 13997->13998 13999 8da087 GetProcAddress 13997->13999 14000 8da0ae FreeLibrary 13998->14000 14001 8d9f9c 13998->14001 13999->13998 14002 8da09b 13999->14002 14000->14001 14001->13971 14002->13998 14003->13985 14005 8d9e7f CallCatchBlock 14004->14005 14006 8d9ee6 _unexpected 14005->14006 14011 8da58e 14005->14011 14006->13987 14032 8df375 LeaveCriticalSection 14008->14032 14010 8d9e55 14010->13977 14010->13990 14012 8da59a __EH_prolog3 14011->14012 14015 8da2e6 14012->14015 14014 8da5c1 _unexpected 14014->14006 14016 8da2f2 CallCatchBlock 14015->14016 14023 8df32d EnterCriticalSection 14016->14023 14018 8da300 14024 8da49e 14018->14024 14023->14018 14025 8da4bd 14024->14025 14026 8da30d 14024->14026 14025->14026 14027 8ddd6e ___free_lconv_mon 14 API calls 14025->14027 14028 8da335 14026->14028 14027->14026 14031 8df375 LeaveCriticalSection 14028->14031 14030 8da31e 14030->14014 14031->14030 14032->14010 14038 8df38c GetPEB 14033->14038 14036 8d9fff 14036->13993 14036->13994 14037 8da030 GetPEB 14037->14036 14039 8da02b 14038->14039 14040 8df3a6 14038->14040 14039->14036 14039->14037 14042 8e046d 14040->14042 14043 8e03ea __dosmaperr 5 API calls 14042->14043 14044 8e0489 14043->14044 14044->14039 14046 8da740 14045->14046 14047 8da752 ___scrt_uninitialize_crt 14045->14047 14048 8da74e 14046->14048 14050 8e0e63 14046->14050 14047->12240 14048->12240 14053 8e0cf0 14050->14053 14056 8e0c44 14053->14056 14057 8e0c50 CallCatchBlock 14056->14057 14064 8df32d EnterCriticalSection 14057->14064 14059 8e0c5a ___scrt_uninitialize_crt 14060 8e0cc6 14059->14060 14065 8e0bb8 14059->14065 14073 8e0ce4 14060->14073 14064->14059 14066 8e0bc4 CallCatchBlock 14065->14066 14076 8e0f80 EnterCriticalSection 14066->14076 14068 8e0c1a 14090 8e0c38 14068->14090 14069 8e0bce ___scrt_uninitialize_crt 14069->14068 14077 8e0dfe 14069->14077 14192 8df375 LeaveCriticalSection 14073->14192 14075 8e0cd2 14075->14048 14076->14069 14078 8e0e13 ___std_exception_copy 14077->14078 14079 8e0e1a 14078->14079 14080 8e0e25 14078->14080 14081 8e0cf0 ___scrt_uninitialize_crt 72 API calls 14079->14081 14093 8e0d95 14080->14093 14083 8e0e20 14081->14083 14085 8dbce0 ___std_exception_copy 43 API calls 14083->14085 14086 8e0e5d 14085->14086 14086->14068 14088 8e0e46 14106 8e2df3 14088->14106 14191 8e0f94 LeaveCriticalSection 14090->14191 14092 8e0c26 14092->14059 14094 8e0dae 14093->14094 14098 8e0dd5 14093->14098 14095 8e2205 ___scrt_uninitialize_crt 43 API calls 14094->14095 14094->14098 14096 8e0dca 14095->14096 14117 8e361e 14096->14117 14098->14083 14099 8e2205 14098->14099 14100 8e2226 14099->14100 14101 8e2211 14099->14101 14100->14088 14102 8ddcfe __dosmaperr 14 API calls 14101->14102 14103 8e2216 14102->14103 14104 8ddc00 ___std_exception_copy 43 API calls 14103->14104 14105 8e2221 14104->14105 14105->14088 14107 8e2e04 14106->14107 14108 8e2e11 14106->14108 14109 8ddcfe __dosmaperr 14 API calls 14107->14109 14110 8e2e5a 14108->14110 14113 8e2e38 14108->14113 14116 8e2e09 14109->14116 14111 8ddcfe __dosmaperr 14 API calls 14110->14111 14112 8e2e5f 14111->14112 14114 8ddc00 ___std_exception_copy 43 API calls 14112->14114 14158 8e2d51 14113->14158 14114->14116 14116->14083 14118 8e362a CallCatchBlock 14117->14118 14119 8e36ee 14118->14119 14121 8e3632 14118->14121 14122 8e367f 14118->14122 14120 8ddb83 ___std_exception_copy 29 API calls 14119->14120 14120->14121 14121->14098 14128 8df50b EnterCriticalSection 14122->14128 14124 8e3685 14125 8e36a2 14124->14125 14129 8e3726 14124->14129 14155 8e36e6 14125->14155 14128->14124 14130 8e374b 14129->14130 14153 8e376e ___scrt_uninitialize_crt 14129->14153 14131 8e374f 14130->14131 14133 8e37ad 14130->14133 14132 8ddb83 ___std_exception_copy 29 API calls 14131->14132 14132->14153 14134 8e37c4 14133->14134 14135 8e58f4 ___scrt_uninitialize_crt 45 API calls 14133->14135 14136 8e32aa ___scrt_uninitialize_crt 44 API calls 14134->14136 14135->14134 14137 8e37ce 14136->14137 14138 8e3814 14137->14138 14139 8e37d4 14137->14139 14140 8e3828 14138->14140 14141 8e3877 WriteFile 14138->14141 14142 8e37fe 14139->14142 14143 8e37db 14139->14143 14146 8e3865 14140->14146 14147 8e3830 14140->14147 14144 8e3899 GetLastError 14141->14144 14141->14153 14145 8e2e70 ___scrt_uninitialize_crt 49 API calls 14142->14145 14150 8e3242 ___scrt_uninitialize_crt 6 API calls 14143->14150 14143->14153 14144->14153 14145->14153 14151 8e3328 ___scrt_uninitialize_crt 7 API calls 14146->14151 14148 8e3835 14147->14148 14149 8e3853 14147->14149 14148->14153 14154 8e3403 ___scrt_uninitialize_crt 7 API calls 14148->14154 14152 8e34ec ___scrt_uninitialize_crt 8 API calls 14149->14152 14150->14153 14151->14153 14152->14153 14153->14125 14154->14153 14156 8df52e ___scrt_uninitialize_crt LeaveCriticalSection 14155->14156 14157 8e36ec 14156->14157 14157->14121 14159 8e2d5d CallCatchBlock 14158->14159 14171 8df50b EnterCriticalSection 14159->14171 14161 8e2d6c 14170 8e2db1 14161->14170 14172 8df5e2 14161->14172 14163 8ddcfe __dosmaperr 14 API calls 14166 8e2db8 14163->14166 14164 8e2d98 FlushFileBuffers 14165 8e2da4 GetLastError 14164->14165 14164->14166 14185 8ddceb 14165->14185 14188 8e2de7 14166->14188 14170->14163 14171->14161 14173 8df5ef 14172->14173 14176 8df604 14172->14176 14174 8ddceb __dosmaperr 14 API calls 14173->14174 14175 8df5f4 14174->14175 14178 8ddcfe __dosmaperr 14 API calls 14175->14178 14177 8ddceb __dosmaperr 14 API calls 14176->14177 14179 8df629 14176->14179 14180 8df634 14177->14180 14181 8df5fc 14178->14181 14179->14164 14182 8ddcfe __dosmaperr 14 API calls 14180->14182 14181->14164 14183 8df63c 14182->14183 14184 8ddc00 ___std_exception_copy 43 API calls 14183->14184 14184->14181 14186 8dd841 __dosmaperr 14 API calls 14185->14186 14187 8ddcf0 14186->14187 14187->14170 14189 8df52e ___scrt_uninitialize_crt LeaveCriticalSection 14188->14189 14190 8e2dd0 14189->14190 14190->14116 14191->14092 14192->14075 15023 8da221 15026 8da186 15023->15026 15027 8da192 CallCatchBlock 15026->15027 15034 8df32d EnterCriticalSection 15027->15034 15029 8da1ca 15035 8da1e8 15029->15035 15031 8da19c 15031->15029 15032 8e0281 ___scrt_uninitialize_crt 14 API calls 15031->15032 15032->15031 15034->15031 15038 8df375 LeaveCriticalSection 15035->15038 15037 8da1d6 15038->15037 14756 8dd5b7 14757 8dd5d2 14756->14757 14758 8dd5c2 14756->14758 14762 8dd5d8 14758->14762 14761 8ddd6e ___free_lconv_mon 14 API calls 14761->14757 14763 8dd5ed 14762->14763 14766 8dd5f3 14762->14766 14764 8ddd6e ___free_lconv_mon 14 API calls 14763->14764 14764->14766 14765 8ddd6e ___free_lconv_mon 14 API calls 14767 8dd5ff 14765->14767 14766->14765 14768 8ddd6e ___free_lconv_mon 14 API calls 14767->14768 14769 8dd60a 14768->14769 14770 8ddd6e ___free_lconv_mon 14 API calls 14769->14770 14771 8dd615 14770->14771 14772 8ddd6e ___free_lconv_mon 14 API calls 14771->14772 14773 8dd620 14772->14773 14774 8ddd6e ___free_lconv_mon 14 API calls 14773->14774 14775 8dd62b 14774->14775 14776 8ddd6e ___free_lconv_mon 14 API calls 14775->14776 14777 8dd636 14776->14777 14778 8ddd6e ___free_lconv_mon 14 API calls 14777->14778 14779 8dd641 14778->14779 14780 8ddd6e ___free_lconv_mon 14 API calls 14779->14780 14781 8dd64c 14780->14781 14782 8ddd6e ___free_lconv_mon 14 API calls 14781->14782 14783 8dd65a 14782->14783 14788 8dd404 14783->14788 14789 8dd410 CallCatchBlock 14788->14789 14804 8df32d EnterCriticalSection 14789->14804 14793 8dd41a 14794 8ddd6e ___free_lconv_mon 14 API calls 14793->14794 14795 8dd444 14793->14795 14794->14795 14805 8dd463 14795->14805 14796 8dd46f 14797 8dd47b CallCatchBlock 14796->14797 14809 8df32d EnterCriticalSection 14797->14809 14799 8dd485 14800 8dd6a5 __dosmaperr 14 API calls 14799->14800 14801 8dd498 14800->14801 14810 8dd4b8 14801->14810 14804->14793 14808 8df375 LeaveCriticalSection 14805->14808 14807 8dd451 14807->14796 14808->14807 14809->14799 14813 8df375 LeaveCriticalSection 14810->14813 14812 8dd4a6 14812->14761 14813->14812 15101 8e0f34 15102 8e0e63 ___scrt_uninitialize_crt 72 API calls 15101->15102 15103 8e0f3c 15102->15103 15111 8e3926 15103->15111 15105 8e0f41 15121 8e39d1 15105->15121 15108 8e0f6b 15109 8ddd6e ___free_lconv_mon 14 API calls 15108->15109 15110 8e0f76 15109->15110 15112 8e3932 CallCatchBlock 15111->15112 15125 8df32d EnterCriticalSection 15112->15125 15114 8e39a9 15132 8e39c8 15114->15132 15115 8e393d 15115->15114 15117 8e397d DeleteCriticalSection 15115->15117 15126 8e5a69 15115->15126 15120 8ddd6e ___free_lconv_mon 14 API calls 15117->15120 15120->15115 15122 8e39e8 15121->15122 15124 8e0f50 DeleteCriticalSection 15121->15124 15123 8ddd6e ___free_lconv_mon 14 API calls 15122->15123 15122->15124 15123->15124 15124->15105 15124->15108 15125->15115 15127 8e5a7c ___std_exception_copy 15126->15127 15135 8e5944 15127->15135 15129 8e5a88 15130 8dbce0 ___std_exception_copy 43 API calls 15129->15130 15131 8e5a94 15130->15131 15131->15115 15207 8df375 LeaveCriticalSection 15132->15207 15134 8e39b5 15134->15105 15136 8e5950 CallCatchBlock 15135->15136 15137 8e597d 15136->15137 15138 8e595a 15136->15138 15145 8e5975 15137->15145 15146 8e0f80 EnterCriticalSection 15137->15146 15139 8ddb83 ___std_exception_copy 29 API calls 15138->15139 15139->15145 15141 8e599b 15147 8e59db 15141->15147 15143 8e59a8 15161 8e59d3 15143->15161 15145->15129 15146->15141 15148 8e5a0b 15147->15148 15149 8e59e8 15147->15149 15151 8e5a03 15148->15151 15152 8e0d95 ___scrt_uninitialize_crt 68 API calls 15148->15152 15150 8ddb83 ___std_exception_copy 29 API calls 15149->15150 15150->15151 15151->15143 15153 8e5a23 15152->15153 15154 8e39d1 14 API calls 15153->15154 15155 8e5a2b 15154->15155 15156 8e2205 ___scrt_uninitialize_crt 43 API calls 15155->15156 15157 8e5a37 15156->15157 15164 8e669c 15157->15164 15160 8ddd6e ___free_lconv_mon 14 API calls 15160->15151 15206 8e0f94 LeaveCriticalSection 15161->15206 15163 8e59d9 15163->15145 15165 8e5a3e 15164->15165 15166 8e66c5 15164->15166 15165->15151 15165->15160 15167 8e6714 15166->15167 15169 8e66ec 15166->15169 15168 8ddb83 ___std_exception_copy 29 API calls 15167->15168 15168->15165 15171 8e660b 15169->15171 15172 8e6617 CallCatchBlock 15171->15172 15179 8df50b EnterCriticalSection 15172->15179 15174 8e6625 15175 8e6656 15174->15175 15180 8e673f 15174->15180 15193 8e6690 15175->15193 15179->15174 15181 8df5e2 ___scrt_uninitialize_crt 43 API calls 15180->15181 15183 8e674f 15181->15183 15182 8e6755 15196 8df551 15182->15196 15183->15182 15185 8df5e2 ___scrt_uninitialize_crt 43 API calls 15183->15185 15192 8e6787 15183->15192 15187 8e677e 15185->15187 15186 8df5e2 ___scrt_uninitialize_crt 43 API calls 15188 8e6793 CloseHandle 15186->15188 15190 8df5e2 ___scrt_uninitialize_crt 43 API calls 15187->15190 15188->15182 15191 8e679f GetLastError 15188->15191 15189 8e67ad ___scrt_uninitialize_crt 15189->15175 15190->15192 15191->15182 15192->15182 15192->15186 15205 8df52e LeaveCriticalSection 15193->15205 15195 8e6679 15195->15165 15197 8df5c7 15196->15197 15198 8df560 15196->15198 15199 8ddcfe __dosmaperr 14 API calls 15197->15199 15198->15197 15202 8df58a 15198->15202 15200 8df5cc 15199->15200 15201 8ddceb __dosmaperr 14 API calls 15200->15201 15203 8df5b7 15201->15203 15202->15203 15204 8df5b1 SetStdHandle 15202->15204 15203->15189 15204->15203 15205->15195 15206->15163 15207->15134 11886 8d2fcd 11887 8d2fde 11886->11887 11888 8d2fe7 11887->11888 11889 8d2ff1 11887->11889 11893 8d30d0 11888->11893 11891 8d2fef 11889->11891 11900 8d3098 11889->11900 11894 8d30ef 11893->11894 11904 8d12ad 11894->11904 11895 8d3144 11898 8d311b 11898->11891 11901 8d30ac 11900->11901 11902 8d30bb 11900->11902 11901->11902 12135 8d131f 11901->12135 11902->11891 11905 8d12f2 11904->11905 11906 8d12bb 11904->11906 11905->11895 11908 8d3024 11905->11908 11906->11905 11914 8d1138 RtlAllocateHeap 11906->11914 11909 8d3036 11908->11909 11912 8d3059 __InternalCxxFrameHandler 11908->11912 11910 8d303f _unexpected 11909->11910 11915 8ddcfe 11909->11915 11910->11912 11913 8ddcfe 14 API calls __dosmaperr 11910->11913 11912->11898 11913->11910 11914->11905 11918 8dd841 GetLastError 11915->11918 11917 8ddd03 11917->11910 11919 8dd857 11918->11919 11920 8dd85d 11918->11920 11941 8e054a 11919->11941 11924 8dd861 SetLastError 11920->11924 11946 8e0589 11920->11946 11924->11917 11928 8dd8a7 11931 8e0589 __dosmaperr 6 API calls 11928->11931 11929 8dd896 11930 8e0589 __dosmaperr 6 API calls 11929->11930 11932 8dd8a4 11930->11932 11933 8dd8b3 11931->11933 11958 8ddd6e 11932->11958 11934 8dd8ce 11933->11934 11935 8dd8b7 11933->11935 11964 8dd51e 11934->11964 11938 8e0589 __dosmaperr 6 API calls 11935->11938 11938->11932 11940 8ddd6e ___free_lconv_mon 12 API calls 11940->11924 11969 8e03ea 11941->11969 11943 8e0566 11944 8e0581 TlsGetValue 11943->11944 11945 8e056f 11943->11945 11945->11920 11947 8e03ea __dosmaperr 5 API calls 11946->11947 11948 8e05a5 11947->11948 11949 8dd879 11948->11949 11950 8e05c3 TlsSetValue 11948->11950 11949->11924 11951 8ddd11 11949->11951 11956 8ddd1e __dosmaperr 11951->11956 11952 8ddd49 RtlAllocateHeap 11954 8dd88e 11952->11954 11952->11956 11953 8ddd5e 11955 8ddcfe __dosmaperr 13 API calls 11953->11955 11954->11928 11954->11929 11955->11954 11956->11952 11956->11953 11983 8e0829 11956->11983 11959 8ddd79 RtlFreeHeap 11958->11959 11960 8ddda3 11958->11960 11959->11960 11961 8ddd8e GetLastError 11959->11961 11960->11924 11962 8ddd9b __dosmaperr 11961->11962 11963 8ddcfe __dosmaperr 12 API calls 11962->11963 11963->11960 11997 8dd3b2 11964->11997 11970 8e0418 11969->11970 11974 8e0414 __dosmaperr 11969->11974 11970->11974 11975 8e031f 11970->11975 11973 8e0432 GetProcAddress 11973->11974 11974->11943 11981 8e0330 11975->11981 11976 8e03c6 11976->11973 11976->11974 11977 8e034e LoadLibraryExW 11978 8e03cd 11977->11978 11979 8e0369 GetLastError 11977->11979 11978->11976 11980 8e03df FreeLibrary 11978->11980 11979->11981 11980->11976 11981->11976 11981->11977 11982 8e039c LoadLibraryExW 11981->11982 11982->11978 11982->11981 11986 8e0856 11983->11986 11987 8e0862 CallCatchBlock 11986->11987 11992 8df32d EnterCriticalSection 11987->11992 11989 8e086d 11993 8e08a9 11989->11993 11992->11989 11996 8df375 LeaveCriticalSection 11993->11996 11995 8e0834 11995->11956 11996->11995 11998 8dd3be CallCatchBlock 11997->11998 12011 8df32d EnterCriticalSection 11998->12011 12000 8dd3c8 12012 8dd3f8 12000->12012 12003 8dd4c4 12004 8dd4d0 CallCatchBlock 12003->12004 12016 8df32d EnterCriticalSection 12004->12016 12006 8dd4da 12017 8dd6a5 12006->12017 12008 8dd4f2 12021 8dd512 12008->12021 12011->12000 12015 8df375 LeaveCriticalSection 12012->12015 12014 8dd3e6 12014->12003 12015->12014 12016->12006 12018 8dd6b4 __dosmaperr 12017->12018 12020 8dd6db __dosmaperr 12017->12020 12018->12020 12024 8dffb4 12018->12024 12020->12008 12134 8df375 LeaveCriticalSection 12021->12134 12023 8dd500 12023->11940 12025 8e0034 12024->12025 12030 8dffca 12024->12030 12026 8e0082 12025->12026 12028 8ddd6e ___free_lconv_mon 14 API calls 12025->12028 12092 8e0125 12026->12092 12031 8e0056 12028->12031 12029 8dfffd 12032 8e001f 12029->12032 12041 8ddd6e ___free_lconv_mon 14 API calls 12029->12041 12030->12025 12030->12029 12035 8ddd6e ___free_lconv_mon 14 API calls 12030->12035 12033 8ddd6e ___free_lconv_mon 14 API calls 12031->12033 12034 8ddd6e ___free_lconv_mon 14 API calls 12032->12034 12036 8e0069 12033->12036 12037 8e0029 12034->12037 12039 8dfff2 12035->12039 12042 8ddd6e ___free_lconv_mon 14 API calls 12036->12042 12045 8ddd6e ___free_lconv_mon 14 API calls 12037->12045 12038 8e00f0 12046 8ddd6e ___free_lconv_mon 14 API calls 12038->12046 12052 8df854 12039->12052 12040 8e0090 12040->12038 12051 8ddd6e 14 API calls ___free_lconv_mon 12040->12051 12043 8e0014 12041->12043 12044 8e0077 12042->12044 12080 8df952 12043->12080 12049 8ddd6e ___free_lconv_mon 14 API calls 12044->12049 12045->12025 12050 8e00f6 12046->12050 12049->12026 12050->12020 12051->12040 12053 8df865 12052->12053 12079 8df94e 12052->12079 12054 8df876 12053->12054 12055 8ddd6e ___free_lconv_mon 14 API calls 12053->12055 12056 8df888 12054->12056 12058 8ddd6e ___free_lconv_mon 14 API calls 12054->12058 12055->12054 12057 8df89a 12056->12057 12059 8ddd6e ___free_lconv_mon 14 API calls 12056->12059 12060 8df8ac 12057->12060 12061 8ddd6e ___free_lconv_mon 14 API calls 12057->12061 12058->12056 12059->12057 12062 8df8be 12060->12062 12063 8ddd6e ___free_lconv_mon 14 API calls 12060->12063 12061->12060 12064 8df8d0 12062->12064 12066 8ddd6e ___free_lconv_mon 14 API calls 12062->12066 12063->12062 12065 8df8e2 12064->12065 12067 8ddd6e ___free_lconv_mon 14 API calls 12064->12067 12068 8df8f4 12065->12068 12069 8ddd6e ___free_lconv_mon 14 API calls 12065->12069 12066->12064 12067->12065 12070 8df906 12068->12070 12071 8ddd6e ___free_lconv_mon 14 API calls 12068->12071 12069->12068 12072 8df918 12070->12072 12074 8ddd6e ___free_lconv_mon 14 API calls 12070->12074 12071->12070 12073 8df92a 12072->12073 12075 8ddd6e ___free_lconv_mon 14 API calls 12072->12075 12076 8ddd6e ___free_lconv_mon 14 API calls 12073->12076 12077 8df93c 12073->12077 12074->12072 12075->12073 12076->12077 12078 8ddd6e ___free_lconv_mon 14 API calls 12077->12078 12077->12079 12078->12079 12079->12029 12081 8df95f 12080->12081 12091 8df9b7 12080->12091 12082 8df96f 12081->12082 12083 8ddd6e ___free_lconv_mon 14 API calls 12081->12083 12084 8df981 12082->12084 12086 8ddd6e ___free_lconv_mon 14 API calls 12082->12086 12083->12082 12085 8df993 12084->12085 12087 8ddd6e ___free_lconv_mon 14 API calls 12084->12087 12088 8ddd6e ___free_lconv_mon 14 API calls 12085->12088 12089 8df9a5 12085->12089 12086->12084 12087->12085 12088->12089 12090 8ddd6e ___free_lconv_mon 14 API calls 12089->12090 12089->12091 12090->12091 12091->12032 12093 8e0132 12092->12093 12094 8e0151 12092->12094 12093->12094 12098 8df9e0 12093->12098 12094->12040 12097 8ddd6e ___free_lconv_mon 14 API calls 12097->12094 12099 8dfabe 12098->12099 12100 8df9f1 12098->12100 12099->12097 12101 8df9bb __dosmaperr 14 API calls 12100->12101 12102 8df9f9 12101->12102 12103 8df9bb __dosmaperr 14 API calls 12102->12103 12104 8dfa04 12103->12104 12105 8df9bb __dosmaperr 14 API calls 12104->12105 12106 8dfa0f 12105->12106 12107 8df9bb __dosmaperr 14 API calls 12106->12107 12108 8dfa1a 12107->12108 12109 8df9bb __dosmaperr 14 API calls 12108->12109 12110 8dfa28 12109->12110 12111 8ddd6e ___free_lconv_mon 14 API calls 12110->12111 12112 8dfa33 12111->12112 12113 8ddd6e ___free_lconv_mon 14 API calls 12112->12113 12114 8dfa3e 12113->12114 12115 8ddd6e ___free_lconv_mon 14 API calls 12114->12115 12116 8dfa49 12115->12116 12117 8df9bb __dosmaperr 14 API calls 12116->12117 12118 8dfa57 12117->12118 12119 8df9bb __dosmaperr 14 API calls 12118->12119 12120 8dfa65 12119->12120 12121 8df9bb __dosmaperr 14 API calls 12120->12121 12122 8dfa76 12121->12122 12123 8df9bb __dosmaperr 14 API calls 12122->12123 12124 8dfa84 12123->12124 12125 8df9bb __dosmaperr 14 API calls 12124->12125 12126 8dfa92 12125->12126 12127 8ddd6e ___free_lconv_mon 14 API calls 12126->12127 12128 8dfa9d 12127->12128 12129 8ddd6e ___free_lconv_mon 14 API calls 12128->12129 12130 8dfaa8 12129->12130 12131 8ddd6e ___free_lconv_mon 14 API calls 12130->12131 12132 8dfab3 12131->12132 12133 8ddd6e ___free_lconv_mon 14 API calls 12132->12133 12133->12099 12134->12023 12136 8d1365 12135->12136 12137 8d132a 12135->12137 12136->11902 12137->12136 12139 8d1168 12137->12139 12140 8d117b 12139->12140 12142 8d1172 12139->12142 12141 8d118b RtlReAllocateHeap 12140->12141 12140->12142 12141->12142 12142->12136 14193 8df4cb 14199 8df3bd 14193->14199 14195 8df4db 14206 8df502 14195->14206 14200 8ddd11 __dosmaperr 14 API calls 14199->14200 14202 8df3cf 14200->14202 14201 8df3dc 14203 8ddd6e ___free_lconv_mon 14 API calls 14201->14203 14202->14201 14209 8e05cb 14202->14209 14205 8df431 14203->14205 14205->14193 14205->14195 14214 8df375 LeaveCriticalSection 14206->14214 14208 8df491 14210 8e03ea __dosmaperr 5 API calls 14209->14210 14211 8e05e7 14210->14211 14212 8e0605 InitializeCriticalSectionAndSpinCount 14211->14212 14213 8e05f0 14211->14213 14212->14213 14213->14202 14214->14208 15424 8e0778 15425 8e0791 15424->15425 15426 8e07af 15424->15426 15425->15426 15427 8df7c8 6 API calls 15425->15427 15427->15425 14215 8e06f9 14216 8e0706 14215->14216 14217 8e0721 14215->14217 14216->14217 14219 8e0712 14216->14219 14218 8e0730 14217->14218 14220 8e2cb5 44 API calls 14217->14220 14222 8e2ce8 16 API calls 14218->14222 14221 8ddcfe __dosmaperr 14 API calls 14219->14221 14220->14218 14223 8e0717 _unexpected 14221->14223 14222->14223

                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                              Function 008D2024 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97fileCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetTempFileNameW.KERNELBASE(?,GUT,00000000,?), ref: 008D2066
                                                                                                                                                                                              • FindResourceW.KERNEL32(00000000,00000066,008EFB3C,?,?), ref: 008D20A8
                                                                                                                                                                                              • LoadResource.KERNEL32(00000000,00000000), ref: 008D20B7
                                                                                                                                                                                              • LockResource.KERNEL32(00000000), ref: 008D20C2
                                                                                                                                                                                              • CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000000,00000000), ref: 008D20E2
                                                                                                                                                                                              • SizeofResource.KERNEL32(00000000,00000000,00000000), ref: 008D20F4
                                                                                                                                                                                              • SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 008D210D
                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 008D2118
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Resource$File$CloseCreateFindHandleLoadLockNamePointerSizeofTemp
                                                                                                                                                                                              • String ID: GUT
                                                                                                                                                                                              • API String ID: 3559219628-559840939
                                                                                                                                                                                              • Opcode ID: 3cfc9899c01c522fac9d61ea024a0be0905b60f349bea6921570ff2832be98ec
                                                                                                                                                                                              • Instruction ID: fb5b104474817192a49a7275ecd1cdfea5832c162b5c465e74cf6e05f92a9642
                                                                                                                                                                                              • Opcode Fuzzy Hash: 3cfc9899c01c522fac9d61ea024a0be0905b60f349bea6921570ff2832be98ec
                                                                                                                                                                                              • Instruction Fuzzy Hash: 3921F571640108BFDB10EBB88CCAEBB776CFB54750F000676BA16D22D1EA70AD448661
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D277B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67libraryloaderCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 008D278F
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 008D2796
                                                                                                                                                                                              • CoInitializeEx.OLE32(00000000,00000006), ref: 008D27AC
                                                                                                                                                                                                • Part of subcall function 008D2604: GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 008D2660
                                                                                                                                                                                                • Part of subcall function 008D2604: RegCreateKeyExW.KERNELBASE(80000001,Software\BraveSoftware\Promo,?,?,?,00020006,?,?,?), ref: 008D268F
                                                                                                                                                                                                • Part of subcall function 008D2604: lstrlenW.KERNEL32(?), ref: 008D26A0
                                                                                                                                                                                                • Part of subcall function 008D2604: RegSetValueExW.KERNELBASE(?,StubInstallerPath,?,00000001,?,00000000), ref: 008D26C3
                                                                                                                                                                                                • Part of subcall function 008D2604: RegCloseKey.ADVAPI32(?), ref: 008D26D3
                                                                                                                                                                                                • Part of subcall function 008D26E9: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 008D2725
                                                                                                                                                                                                • Part of subcall function 008D18B8: DeleteFileW.KERNELBASE(00000000,00000000,?,00000000,?,008D2845,?,?), ref: 008D18DA
                                                                                                                                                                                                • Part of subcall function 008D18B8: RemoveDirectoryW.KERNELBASE(?,?,00000000,?,008D2845,?,?), ref: 008D18F2
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FileModule$Name$AddressCloseCreateDeleteDirectoryHandleInitializeProcRemoveValuelstrlen
                                                                                                                                                                                              • String ID: SetDefaultDllDirectories$kernel32.dll
                                                                                                                                                                                              • API String ID: 3408119680-2102062458
                                                                                                                                                                                              • Opcode ID: c556eb4c774f0432f7cca8b85b204fb63a7961de1cb50807d1dbea1986ad2356
                                                                                                                                                                                              • Instruction ID: 7a586bdd5860eba126b39a5b8c4b8ad535155d774ad142612cd17166ab2fc683
                                                                                                                                                                                              • Opcode Fuzzy Hash: c556eb4c774f0432f7cca8b85b204fb63a7961de1cb50807d1dbea1986ad2356
                                                                                                                                                                                              • Instruction Fuzzy Hash: A6216A30508312ABC614EF68D86585EBBA4FFA4764F004A6EF495D22A1EF70DA05CB93
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D3B7C Relevance: 415.5, APIs: 1, Strings: 236, Instructions: 798COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 008D4AF5
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Init_thread_footer
                                                                                                                                                                                              • String ID: AAV730$ABO677$AMV588$ANM246$APG060$APN295$APV192$ARO656$ASY224$BEM856$BHD893$BNI512$BOA207$BSB375$BSC752$BTZ601$BUE553$BWC385$BXN418$BXV384$BYJ598$CBW249$CCJ078$CCQ716$CCU246$CEL792$CFT923$CHY006$CJO449$CSY475$CTD238$CVB741$CZQ141$DFG223$DFQ107$DHU083$DKD200$DLQ981$DPM796$DPX255$DRR783$DSE071$DSL157$DVZ178$DWC715$DZF201$EBC998$EDE311$EHH775$EKB849$EPH628$ERQ913$ERW274$ERX748$ESP177$EZM037$EZM787$FBI093$FBW502$FEB604$FEX878$FFL997$FQW627$FST304$FUX638$GFQ506$GMM900$GMV203$GTW616$HFS553$HLK526$HQK918$HQL833$HXM441$HYJ986$IBU843$IFN767$IJZ122$ILY758$IOB292$IOJ320$IQC112$ITO318$IUX155$IXQ557$IXX292$JDT909$JJE625$JQP631$JRN526$JWA535$JYK534$KBJ557$KJD945$KJP000$KSU863$KVC600$KWZ833$KXC376$KYW570$LDD929$LIR950$LJT611$LRT088$LSS305$LWP706$LYD303$MEB961$MGD911$MJM666$MMT745$MOU235$MPO928$MQP631$MSG315$MTB027$MTS962$MZJ289$MZX864$NFF966$NGU383$NGY511$NHX686$NKZ324$NOQ491$NRX711$NUB585$NWN118$OCA003$OIE359$OIL401$OIQ043$OJV851$OLS686$OOB354$OOJ613$OOX752$OPV062$ORX404$OSB729$OVK455$OXU789$OZC828$OZD582$PJJ948$PNE044$PPD370$PRI875$PSN487$PZH825$QAA606$QFE427$QJQ727$QLM391$QPE677$QXS120$RBW016$RDS304$RHI430$RMB905$RMB962$RNH069$RPW794$RQH046$RZD797$SBW951$SFM009$SIV168$SLY677$SOB084$SOB703$TBD002$TJF413$TJK021$TNW414$TOT965$TQD211$TRR894$TSM531$TVJ301$TZS401$UEO521$UGI415$UGO473$UIH408$UNK157$UNQ913$UPF883$UPQ934$UQN934$UQS362$UTD029$UUD854$VBC538$VBQ225$VGT997$VIW485$VNI569$VWK786$VZF120$WGN943$WIR635$WIV076$WIX525$WKG906$WLJ467$XER314$XMW172$XMZ986$XOB016$XOX898$XPM257$XPO114$XTA152$YAB346$YBX790$YDQ106$YHC941$YHS197$YIZ978$YPH104$YQI537$YXG330$YXT225$YZR853$YZV909$ZGL739$ZIQ953$ZJN514$ZMC689$ZQM087$ZTT758$ZVI549$ZWR105$ZWV410$ZYB215
                                                                                                                                                                                              • API String ID: 1385522511-319640288
                                                                                                                                                                                              • Opcode ID: d8e1c50fe4785629478c3f9655d619ee880c53960bbd1de53f0b94adba08ef53
                                                                                                                                                                                              • Instruction ID: af940ba9755a1fc0bf948205e3479f272a95d8a9a6a6a1ee4b8836b01dac8391
                                                                                                                                                                                              • Opcode Fuzzy Hash: d8e1c50fe4785629478c3f9655d619ee880c53960bbd1de53f0b94adba08ef53
                                                                                                                                                                                              • Instruction Fuzzy Hash: 4E7237305512589ED754EB25CC63FEC7320FB20710F904AEAA199F23929EF46B86CE56
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D1935 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 245stringCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 504 8d1935-8d1954 call 8d1edd 507 8d1969-8d197d call 8d2024 504->507 508 8d1956-8d195f call 8d1fad 504->508 513 8d1cce 507->513 514 8d1983-8d19c8 call 8d2f7a 507->514 508->507 515 8d1961-8d1964 508->515 516 8d1cd0-8d1cde call 8d7182 513->516 521 8d19ce-8d19e2 call 8d3555 514->521 515->516 524 8d1cbc-8d1cc2 call 8d3520 521->524 525 8d19e8-8d19ef 521->525 529 8d1cc7-8d1cc8 CloseHandle 524->529 525->521 526 8d19f1-8d19fa call 8d2132 525->526 526->524 531 8d1a00-8d1a12 526->531 529->513 531->524 532 8d1a18-8d1a88 call 8d2f7a call 8d2c26 PathQuoteSpacesW call 8d28b9 call 8d7760 GetModuleFileNameW 531->532 541 8d1a8a-8d1a8c 532->541 542 8d1aa3-8d1aa5 532->542 541->542 543 8d1a8e-8d1a94 call 8d1570 541->543 544 8d1aab-8d1ab4 542->544 549 8d1a99-8d1aa1 543->549 546 8d1c0e-8d1c2c call 8d14eb call 8d1cdf 544->546 547 8d1aba-8d1abc 544->547 560 8d1c31-8d1c3f call 8d1db4 546->560 550 8d1abe-8d1ad5 call 8d254e call 8d2f5f 547->550 551 8d1ada-8d1b3d call 8d2b50 call 8d2bff call 8d3155 call 8d2aa0 lstrcmpiW call 8d2f5f 547->551 549->544 550->524 581 8d1b42-8d1b44 551->581 567 8d1c8d-8d1c9d call 8d37e2 560->567 568 8d1c41-8d1c43 560->568 572 8d1ca2-8d1ca6 567->572 568->567 571 8d1c45-8d1c88 call 8d2b50 call 8d31c7 call 8d14eb call 8d2f5f 568->571 571->567 575 8d1caf-8d1cba call 8d2f5f 572->575 576 8d1ca8-8d1cae call 8e85b1 572->576 575->524 576->575 585 8d1bcd-8d1bed call 8d14eb 581->585 586 8d1b4a-8d1bcb call 8d2a5b call 8e879b call 8e99b0 call 8e85b1 call 8d14eb call 8d2f5f 581->586 596 8d1bf0-8d1c0c call 8d2f5f * 2 585->596 586->596 596->560
                                                                                                                                                                                              APIs
                                                                                                                                                                                                • Part of subcall function 008D1EDD: IsUserAnAdmin.SHELL32 ref: 008D1EE6
                                                                                                                                                                                              • PathQuoteSpacesW.SHLWAPI(00000000,00000104,?), ref: 008D1A4F
                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 008D1A80
                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?), ref: 008D1CC8
                                                                                                                                                                                                • Part of subcall function 008D1FAD: GetTempPathW.KERNEL32(00000104,00000000,00000104,?,?,?,008D195D), ref: 008D1FDC
                                                                                                                                                                                              • lstrcmpiW.KERNELBASE(00000000,?,?,00000000,?,?,00000104), ref: 008D1B2F
                                                                                                                                                                                              • _strncpy.LIBCMT ref: 008D1B89
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Path$AdminCloseFileHandleModuleNameQuoteSpacesTempUser_strncpylstrcmpi
                                                                                                                                                                                              • String ID: "%s"$ %s$ /%s %s /%s$ /%s /%s$&%s$&referral=%s$install$installsource$silent$taggedmi
                                                                                                                                                                                              • API String ID: 2688778804-3043945572
                                                                                                                                                                                              • Opcode ID: 13a1239c48428dfff3427eed4541bf862f288ec0768bebf24cee68f5ded58f3e
                                                                                                                                                                                              • Instruction ID: 9373bc37260867d6afe62acaa7b2945c68601504fcc5f5c10788826d566e8b61
                                                                                                                                                                                              • Opcode Fuzzy Hash: 13a1239c48428dfff3427eed4541bf862f288ec0768bebf24cee68f5ded58f3e
                                                                                                                                                                                              • Instruction Fuzzy Hash: CA91937194011CAACF20EB68DC89ADDB7B5FF65310F1006EAA409E7392EE749E85CF51
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D3555 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 159fileCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 631 8d3555-8d359f call 8e84f0 ReadFile 634 8d3768 631->634 635 8d35a5-8d35af 631->635 636 8d376a-8d3778 call 8d7182 634->636 635->634 637 8d35b5-8d35cd call 8e8874 635->637 642 8d35cf-8d35d2 637->642 643 8d35d7-8d35ef call 8e8874 637->643 642->636 643->634 646 8d35f5-8d364e call 8d2f7a call 8d377b * 2 CreateFileW 643->646 653 8d3759-8d3766 call 8d2f5f 646->653 654 8d3654-8d368f call 8e9ad4 SetFilePointer 646->654 653->636 659 8d3706-8d3718 FindCloseChangeNotification 654->659 660 8d3691-8d369e 654->660 661 8d371a-8d371d 659->661 662 8d3742-8d3745 659->662 663 8d36a8-8d36c3 ReadFile 660->663 664 8d36a0-8d36a2 660->664 667 8d371f-8d3729 call 8d293d 661->667 668 8d372e-8d3733 661->668 669 8d3747-8d374d SetFilePointer 662->669 670 8d3753 662->670 665 8d36c5-8d36e8 WriteFile 663->665 666 8d3700 663->666 664->663 665->666 671 8d36ea-8d36fc 665->671 666->659 667->668 668->662 673 8d3735-8d3741 668->673 669->670 670->653 671->660 674 8d36fe 671->674 673->662 674->659
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • ReadFile.KERNELBASE(?,?,00000200,?,00000000,?,00000000,?,?,008D19E0,?), ref: 008D3597
                                                                                                                                                                                              • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000100,00000000,?,008EFDC8), ref: 008D363F
                                                                                                                                                                                              • SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 008D3673
                                                                                                                                                                                              • ReadFile.KERNELBASE(?,?,00040000,?,00000000), ref: 008D36BB
                                                                                                                                                                                              • WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 008D36E0
                                                                                                                                                                                              • FindCloseChangeNotification.KERNELBASE(?), ref: 008D370C
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: File$Read$ChangeCloseCreateFindNotificationPointerWrite
                                                                                                                                                                                              • String ID: ustar
                                                                                                                                                                                              • API String ID: 3368226178-529472938
                                                                                                                                                                                              • Opcode ID: 76ce07ac194683a5adc99b47b42ca34897cf58f22aa5c7f5c690cf8922cf44ce
                                                                                                                                                                                              • Instruction ID: abcb1a30d23744c56baff1a98294a9e4ec9f6adf9da72587c60f4b2d4b482c18
                                                                                                                                                                                              • Opcode Fuzzy Hash: 76ce07ac194683a5adc99b47b42ca34897cf58f22aa5c7f5c690cf8922cf44ce
                                                                                                                                                                                              • Instruction Fuzzy Hash: 5451B5F194061DAFDB249B64DD89EAA7778FF04304F0006FAE609F6291E6B09B84CF15
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D2604 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71registrystringCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 676 8d2604-8d2637 call 8d2b50 call 8d2f5f 681 8d263d-8d2668 call 8d7760 GetModuleFileNameW 676->681 682 8d26d9-8d26e8 call 8d7182 676->682 681->682 687 8d266a-8d266c 681->687 687->682 688 8d266e-8d2697 RegCreateKeyExW 687->688 688->682 689 8d2699-8d26cb lstrlenW RegSetValueExW 688->689 689->682 690 8d26cd-8d26d3 RegCloseKey 689->690 690->682
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 008D2660
                                                                                                                                                                                              • RegCreateKeyExW.KERNELBASE(80000001,Software\BraveSoftware\Promo,?,?,?,00020006,?,?,?), ref: 008D268F
                                                                                                                                                                                              • lstrlenW.KERNEL32(?), ref: 008D26A0
                                                                                                                                                                                              • RegSetValueExW.KERNELBASE(?,StubInstallerPath,?,00000001,?,00000000), ref: 008D26C3
                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 008D26D3
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CloseCreateFileModuleNameValuelstrlen
                                                                                                                                                                                              • String ID: Software\BraveSoftware\Promo$StubInstallerPath
                                                                                                                                                                                              • API String ID: 2554618631-4237694635
                                                                                                                                                                                              • Opcode ID: dd65bb53b2136406211ee69afcaa52f8397e4863693996f1d3517ca8a3b479a7
                                                                                                                                                                                              • Instruction ID: 6e2bd71de8afb407f0cf28a8b12ba5f87694255e4a57289d9afac909012e3dd7
                                                                                                                                                                                              • Opcode Fuzzy Hash: dd65bb53b2136406211ee69afcaa52f8397e4863693996f1d3517ca8a3b479a7
                                                                                                                                                                                              • Instruction Fuzzy Hash: 5821967054522CABDB20DB51DC8DFDB7B7CFF25750F0006A6B50AE6251EA709A84CBA1
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D37E2 Relevance: 10.6, APIs: 7, Instructions: 84processsynchronizationCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetStartupInfoW.KERNEL32(?,?,?,00000000), ref: 008D381C
                                                                                                                                                                                              • CreateProcessW.KERNELBASE(00000000,00000010,00000000,00000000,00000000,00000400,00000000,00000000,?,?), ref: 008D3857
                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 008D3861
                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF), ref: 008D3873
                                                                                                                                                                                              • GetExitCodeProcess.KERNELBASE(?,?), ref: 008D3884
                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 008D389D
                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 008D38A2
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CloseHandleProcess$CodeCreateErrorExitInfoLastObjectSingleStartupWait
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2373000011-0
                                                                                                                                                                                              • Opcode ID: dcf3c65e50b95b152c95d2362fdf31ea5ef6b25d6178c88e62923c6c483f3d17
                                                                                                                                                                                              • Instruction ID: 9a0606e446a656d9047bdca2f1b5d1386b9cd72e55571d1a5926e79a89178529
                                                                                                                                                                                              • Opcode Fuzzy Hash: dcf3c65e50b95b152c95d2362fdf31ea5ef6b25d6178c88e62923c6c483f3d17
                                                                                                                                                                                              • Instruction Fuzzy Hash: A6213B7190020DBFDB009BB5DC869AEBB7CFF04754F104576B512E7260EA306E45DB62
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D1EDD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • IsUserAnAdmin.SHELL32 ref: 008D1EE6
                                                                                                                                                                                              • SHGetFolderPathW.SHELL32(00000000,00008026,00000000,00000000,00000000,00000104,?,?,?,?,008D1952), ref: 008D1F25
                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(?,00000000,BraveSoftware,?,?,?,?,?,008D1952), ref: 008D1F55
                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,008D1952), ref: 008D1F5F
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AdminCreateDirectoryErrorFolderLastPathUser
                                                                                                                                                                                              • String ID: BraveSoftware$Temp
                                                                                                                                                                                              • API String ID: 943171645-1868006839
                                                                                                                                                                                              • Opcode ID: 55b011feee31becea0525692246716aff8343349f05af25301f45ac40aa84390
                                                                                                                                                                                              • Instruction ID: 8f947cf26a404e04ec36c3f44ea142c13cd8ba00fd9800ed139c0227f6683675
                                                                                                                                                                                              • Opcode Fuzzy Hash: 55b011feee31becea0525692246716aff8343349f05af25301f45ac40aa84390
                                                                                                                                                                                              • Instruction Fuzzy Hash: 81215171900249BFCF14EBA9CD968EEB779FF21754F500266E402E2292EF709F05DA61
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D1E34 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59fileCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 737 8d1e34-8d1e4f CreateDirectoryW 738 8d1e51-8d1e5c GetLastError 737->738 739 8d1e62-8d1e9e call 8d2bff call 8d2c26 GetTempFileNameW call 8d28b9 737->739 738->739 740 8d1e5e-8d1e60 738->740 748 8d1ecd-8d1ed5 call 8d2f5f 739->748 749 8d1ea0-8d1ea3 739->749 742 8d1ed7-8d1eda 740->742 748->742 749->748 750 8d1ea5-8d1eba DeleteFileW CreateDirectoryW 749->750 750->748 753 8d1ebc-8d1ecb call 8d2aef 750->753 753->748
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(?,00000000,?,00000000,Temp,?,?,?,?,008D1952), ref: 008D1E47
                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000000,Temp,?,?,?,?,008D1952), ref: 008D1E51
                                                                                                                                                                                              • GetTempFileNameW.KERNELBASE(?,GUM,00000000,00000000,00000104,?,00000000,Temp), ref: 008D1E8C
                                                                                                                                                                                              • DeleteFileW.KERNELBASE(000000FF,?,00000000,Temp), ref: 008D1EA8
                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(000000FF,00000000,?,00000000,Temp), ref: 008D1EB2
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CreateDirectoryFile$DeleteErrorLastNameTemp
                                                                                                                                                                                              • String ID: GUM
                                                                                                                                                                                              • API String ID: 55127950-1161156203
                                                                                                                                                                                              • Opcode ID: 123c66f8e8d7f4ae272354a9881a705cf475501fd45a83a41e1e6066f052fb9a
                                                                                                                                                                                              • Instruction ID: 5aeb842cc26b5d4d2dfda3c15e1e171215055b279ebebeb6ebbe22aa7ed7ff8d
                                                                                                                                                                                              • Opcode Fuzzy Hash: 123c66f8e8d7f4ae272354a9881a705cf475501fd45a83a41e1e6066f052fb9a
                                                                                                                                                                                              • Instruction Fuzzy Hash: 51119171500209BFDF04AFA9CC898AD7BB9FF54750B10062AF815DA2A0EB31AE46DB51
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D344A Relevance: 7.6, APIs: 5, Instructions: 64fileCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 789 8d344a-8d347a call 8d34e2 CreateFileW 792 8d347c-8d348e CreateFileMappingW 789->792 793 8d34da 789->793 795 8d3490-8d34a3 MapViewOfFile 792->795 796 8d34d3-8d34d5 call 8d34e2 792->796 794 8d34dc-8d34df 793->794 798 8d34ca-8d34cd CloseHandle 795->798 799 8d34a5-8d34be VirtualQuery 795->799 796->793 798->796 799->798 800 8d34c0-8d34c8 799->800 800->794
                                                                                                                                                                                              APIs
                                                                                                                                                                                                • Part of subcall function 008D34E2: UnmapViewOfFile.KERNEL32(00000000,?,008D3433,?,?,80004005,74DEE010,?,?,?,008D14FB), ref: 008D34EE
                                                                                                                                                                                                • Part of subcall function 008D34E2: CloseHandle.KERNEL32(00000000,?,008D3433,?,?,80004005,74DEE010,?,?,?,008D14FB), ref: 008D3501
                                                                                                                                                                                                • Part of subcall function 008D34E2: CloseHandle.KERNEL32(000000FF,?,008D3433,?,?,80004005,74DEE010,?,?,?,008D14FB), ref: 008D3514
                                                                                                                                                                                              • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,?,?,008D15A4), ref: 008D346E
                                                                                                                                                                                              • CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,008D15A4), ref: 008D3483
                                                                                                                                                                                              • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000,?,?,?,?,?,?,008D15A4), ref: 008D3496
                                                                                                                                                                                              • VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,?,?,?,008D15A4), ref: 008D34B6
                                                                                                                                                                                              • CloseHandle.KERNEL32(6E6B6E75,?,?,?,?,?,?,008D15A4), ref: 008D34CD
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: File$CloseHandle$CreateView$MappingQueryUnmapVirtual
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1729669285-0
                                                                                                                                                                                              • Opcode ID: a16e8bad843a5a96a7e0add32d83e04f03f3eac7fff659bb71c5ec72d849afd4
                                                                                                                                                                                              • Instruction ID: 581e99341104b72b01d9171d6f98e8d6596110cf39808d036d50ab4b128d5635
                                                                                                                                                                                              • Opcode Fuzzy Hash: a16e8bad843a5a96a7e0add32d83e04f03f3eac7fff659bb71c5ec72d849afd4
                                                                                                                                                                                              • Instruction Fuzzy Hash: 2611A370600341BAD7356B36DC09F577F7AFBD1B10F00861DB916E6290DA74A541C625
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D2132 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56fileCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000104,?,00000000,?,008D19F8,?), ref: 008D2164
                                                                                                                                                                                                • Part of subcall function 008D2860: PathAppendW.SHLWAPI(00000000,?,00000104,?,00000000,?,008D1F51,BraveSoftware,?,?,?,?,?,008D1952), ref: 008D2875
                                                                                                                                                                                              • CopyFileW.KERNELBASE(?,?,00000000,BraveUpdateSetup.exe,?,?,00000000,?,008D19F8,?), ref: 008D219F
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: File$AppendCopyModuleNamePath
                                                                                                                                                                                              • String ID: BraveUpdateSetup.exe
                                                                                                                                                                                              • API String ID: 1240757089-2590033563
                                                                                                                                                                                              • Opcode ID: d09fed9f8348d45855e4c3e4f88fbbc5bf0c1e5cdafcd9f7c7b7b6a3b2700096
                                                                                                                                                                                              • Instruction ID: ac09cfdd0363a80d51810f48e4abdeaaf8ea6d6539ccadc109a63a00905a804a
                                                                                                                                                                                              • Opcode Fuzzy Hash: d09fed9f8348d45855e4c3e4f88fbbc5bf0c1e5cdafcd9f7c7b7b6a3b2700096
                                                                                                                                                                                              • Instruction Fuzzy Hash: F0117075900108AFCF14EBA8C8918EEB77CFF65310B10066AE552E2291EF706F05DA61
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D9FF5 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(008DA108,?,008D9FEF,00000000,?,?,008DA108,30CA9840,?,008DA108), ref: 008DA006
                                                                                                                                                                                              • TerminateProcess.KERNEL32(00000000,?,008D9FEF,00000000,?,?,008DA108,30CA9840,?,008DA108), ref: 008DA00D
                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 008DA01F
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                              • Opcode ID: 5332c436b47010a77f8baf8a2cbdd26e24c52381db636f4fcdc6a1d09d0719e6
                                                                                                                                                                                              • Instruction ID: bbdf71d37d4b098d63bcca5ef9ed221c7f8b5110b307d5b234e9cee966223778
                                                                                                                                                                                              • Opcode Fuzzy Hash: 5332c436b47010a77f8baf8a2cbdd26e24c52381db636f4fcdc6a1d09d0719e6
                                                                                                                                                                                              • Instruction Fuzzy Hash: 1CD05E31000E48EBCF183F60DC0D9483F2AFF04740B104011F804C9132CB35AE469A53
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D4B06 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                                • Part of subcall function 008D3A75: lstrcpynW.KERNEL32(?,?,00000104,?,?), ref: 008D3A99
                                                                                                                                                                                                • Part of subcall function 008D3A75: PathStripPathW.SHLWAPI(?,?,00000104,?,?), ref: 008D3AA6
                                                                                                                                                                                                • Part of subcall function 008D3A75: PathRemoveExtensionW.SHLWAPI(?,?,00000104,?,?), ref: 008D3AB3
                                                                                                                                                                                                • Part of subcall function 008D3A75: lstrlenW.KERNEL32(?,?,00000104,?,?), ref: 008D3AC6
                                                                                                                                                                                                • Part of subcall function 008D3A75: lstrlenW.KERNEL32(?,?,00000104,?,?), ref: 008D3ADC
                                                                                                                                                                                              • CharUpperBuffW.USER32(00000000,?,?,00000104,?,?,?,?,008D2752,?), ref: 008D4B43
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Path$lstrlen$BuffCharExtensionRemoveStripUpperlstrcpyn
                                                                                                                                                                                              • String ID: none
                                                                                                                                                                                              • API String ID: 1330847136-2140143823
                                                                                                                                                                                              • Opcode ID: ad23451f29cd7e4d7e9b3e9c053db2725e62a053ec620776b414db5f657b82fc
                                                                                                                                                                                              • Instruction ID: b30ada6ddddda3911e2c8a1267e2ab38be9c56bb0b946a58f2612e782e3310e5
                                                                                                                                                                                              • Opcode Fuzzy Hash: ad23451f29cd7e4d7e9b3e9c053db2725e62a053ec620776b414db5f657b82fc
                                                                                                                                                                                              • Instruction Fuzzy Hash: 09016171500105EB8B08EB98C8569EEB37AFE61324720079FB05297392DF706F05DB51
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D26E9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 853 8d26e9-8d272d call 8d7760 GetModuleFileNameW 856 8d275f-8d2766 call 8d2ba0 853->856 857 8d272f-8d2731 853->857 861 8d276b-8d277a call 8d7182 856->861 857->856 858 8d2733-8d274d call 8d2ba0 call 8d4b06 857->858 866 8d2752-8d275d call 8d2f5f 858->866 866->861
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 008D2725
                                                                                                                                                                                                • Part of subcall function 008D4B06: CharUpperBuffW.USER32(00000000,?,?,00000104,?,?,?,?,008D2752,?), ref: 008D4B43
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: BuffCharFileModuleNameUpper
                                                                                                                                                                                              • String ID: none
                                                                                                                                                                                              • API String ID: 2024523369-2140143823
                                                                                                                                                                                              • Opcode ID: fcd8dd4c9d6cf54e991eabd0d73b07fd4d4be87e48872a387c22e93bb2d73658
                                                                                                                                                                                              • Instruction ID: bc03b2276cc2a48005885925c324ae4b0abb51013f8c8684286f178d126fa999
                                                                                                                                                                                              • Opcode Fuzzy Hash: fcd8dd4c9d6cf54e991eabd0d73b07fd4d4be87e48872a387c22e93bb2d73658
                                                                                                                                                                                              • Instruction Fuzzy Hash: 8601887074011C97DB20FB25DD4AFEE7368FB61711F400AA7A405D6381EEB05F45C6A2
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D18B8 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • DeleteFileW.KERNELBASE(00000000,00000000,?,00000000,?,008D2845,?,?), ref: 008D18DA
                                                                                                                                                                                              • RemoveDirectoryW.KERNELBASE(?,?,00000000,?,008D2845,?,?), ref: 008D18F2
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: DeleteDirectoryFileRemove
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3325800564-0
                                                                                                                                                                                              • Opcode ID: d38843d35d7ea852bea3c3da145990f218ec1f9d54adc7511f1d4cdbde66dfe5
                                                                                                                                                                                              • Instruction ID: 4a05e4dac232de49c7b3cd1d97176a06dde5823b40c2298b86b97fb7b101316c
                                                                                                                                                                                              • Opcode Fuzzy Hash: d38843d35d7ea852bea3c3da145990f218ec1f9d54adc7511f1d4cdbde66dfe5
                                                                                                                                                                                              • Instruction Fuzzy Hash: D10144311006049BC635FF28C8A587AB7B2FFA17417100B7EA05B96B66DF70B94ED752
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008DDD6E Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • RtlFreeHeap.NTDLL(00000000,00000000,?,008DF9D4,008DBD16,00000000,008DBD16,?,008DF9F9,008DBD16,00000007,008DBD16,?,008E014B,008DBD16,008DBD16), ref: 008DDD84
                                                                                                                                                                                              • GetLastError.KERNEL32(008DBD16,?,008DF9D4,008DBD16,00000000,008DBD16,?,008DF9F9,008DBD16,00000007,008DBD16,?,008E014B,008DBD16,008DBD16), ref: 008DDD8F
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                              • Opcode ID: 44c560164d9fd8aef38bb3c75e193bda04d51976c0763fe981332f20432304d0
                                                                                                                                                                                              • Instruction ID: 74528960983810749aae7dcfcf76a9252ca7a576542d460ee0d38e1e7c619f0c
                                                                                                                                                                                              • Opcode Fuzzy Hash: 44c560164d9fd8aef38bb3c75e193bda04d51976c0763fe981332f20432304d0
                                                                                                                                                                                              • Instruction Fuzzy Hash: AFE08C32500B14EFCB213FB9EC48F993B69FB40B91F004122F608DB270CA709950C781
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D2DC4 Relevance: 2.5, APIs: 2, Instructions: 39COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,?,?,?,008D37BD,008D3618,?,?), ref: 008D2DDD
                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,-00000001,-00000001,?,008D37BD,008D3618,?,?), ref: 008D2DFD
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 626452242-0
                                                                                                                                                                                              • Opcode ID: 2133ad7ba89b9857fb5eb5d151a7082c94368e8ea20c2d5a23b79b2fbe37f7b9
                                                                                                                                                                                              • Instruction ID: e17f21abc8272dc14f702f3b1adf8450b049de19b9a845370d2602ab39134879
                                                                                                                                                                                              • Opcode Fuzzy Hash: 2133ad7ba89b9857fb5eb5d151a7082c94368e8ea20c2d5a23b79b2fbe37f7b9
                                                                                                                                                                                              • Instruction Fuzzy Hash: 35F0BE31200514BAEA115A488D09F7EB76DEFA0F60F10031ABA18DA2E1CAA05E0586A6
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D2369 Relevance: 1.7, APIs: 1, Instructions: 164COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID:
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                              • Opcode ID: 57c31de73cc56e4ce10e6c9aba2d79492846a39cb9d42eea0eea9358b5eb62d0
                                                                                                                                                                                              • Instruction ID: 862fcf164ed1a660934d818d0903f1d800be2246f646df264727c46468c6525d
                                                                                                                                                                                              • Opcode Fuzzy Hash: 57c31de73cc56e4ce10e6c9aba2d79492846a39cb9d42eea0eea9358b5eb62d0
                                                                                                                                                                                              • Instruction Fuzzy Hash: D0510871D002289FDB24DFA9DC80AADBBB9FF49314F1442AAE91DE7341EA3099458F51
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008E2CE8 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                                • Part of subcall function 008DFAE8: RtlAllocateHeap.NTDLL(00000000,008DEBDC,?,?,008DEBDC,00000220,?,?,?), ref: 008DFB1A
                                                                                                                                                                                              • RtlReAllocateHeap.NTDLL(00000000,00000000,008D14FB,008DA626,00000000,?,008E0742,00000000,008DA626,00000028,?,00000024,?,008DA420,?,00000028), ref: 008E2D45
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AllocateHeap
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1279760036-0
                                                                                                                                                                                              • Opcode ID: b45a3a89141afa60faefe639994a90b06279c3f67566c2bd8d9febf82117f9f9
                                                                                                                                                                                              • Instruction ID: c44dab0d2d7dfc0107c2942fba4733e55e8fe4430cedccf20b8fe56bd2285165
                                                                                                                                                                                              • Opcode Fuzzy Hash: b45a3a89141afa60faefe639994a90b06279c3f67566c2bd8d9febf82117f9f9
                                                                                                                                                                                              • Instruction Fuzzy Hash: FDF0C83270019DAA9B322A6B9C00B6F275CFF83770B254126FA15D7291DA24D8009192
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008DDD11 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000008,00000401,FFFFFEAF,?,008DD935,00000001,00000364,00000006,000000FF,008DD048,FFFFFEAF,?,008DBF1A,008DDB81,F08BD84D,FFFFFEAF), ref: 008DDD52
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AllocateHeap
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1279760036-0
                                                                                                                                                                                              • Opcode ID: 2f33534515cef2ed80f08c8a7d78be8ad4ddc3322158f681d0e713e5025e2202
                                                                                                                                                                                              • Instruction ID: 1ace573c4009b546103d9676b5806e5a64ad31f917b6668fb36f7584523a083a
                                                                                                                                                                                              • Opcode Fuzzy Hash: 2f33534515cef2ed80f08c8a7d78be8ad4ddc3322158f681d0e713e5025e2202
                                                                                                                                                                                              • Instruction Fuzzy Hash: 64F0B432601728ABDF216A679C01B5A375AFF82770B154723B804DB3A5CA20E800C6E1
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008DFAE8 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,008DEBDC,?,?,008DEBDC,00000220,?,?,?), ref: 008DFB1A
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AllocateHeap
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1279760036-0
                                                                                                                                                                                              • Opcode ID: b6d4c8f3ff0bf26e3850ec1eb96c963140def5e6908b21a9b8880bdfe619294b
                                                                                                                                                                                              • Instruction ID: b87f67830c29f2f13dc80d8eb19f7cb32c9d7d4310b918f613b671e8209feaac
                                                                                                                                                                                              • Opcode Fuzzy Hash: b6d4c8f3ff0bf26e3850ec1eb96c963140def5e6908b21a9b8880bdfe619294b
                                                                                                                                                                                              • Instruction Fuzzy Hash: A2E0E531240621ABEA31266AEC11F5B374DFF013B0F141333BE06D6392CE50CC00A2E2
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D1168 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID:
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                              • Opcode ID: 9538006935ead0562a153d7e457a394b1ab3e2d5d5be750a407c659b5194fc37
                                                                                                                                                                                              • Instruction ID: bc9954bbfc8bb69f9261a9ec082bb174168c61059cc3b8f7ef9469b3cd191a4c
                                                                                                                                                                                              • Opcode Fuzzy Hash: 9538006935ead0562a153d7e457a394b1ab3e2d5d5be750a407c659b5194fc37
                                                                                                                                                                                              • Instruction Fuzzy Hash: CBE0E530204208FFDF009F60DC88B693BB5FF98715F24D169F52A8E220C732E915AB50
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D3520 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • DeleteFileW.KERNELBASE(00000000,00000000,?,00000000,?,008D1CC7,?), ref: 008D3537
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: DeleteFile
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 4033686569-0
                                                                                                                                                                                              • Opcode ID: 5f2b6d7808a3ea70d0b20ab0ed2f5dc32236610a65f1ac5633372f62af129d48
                                                                                                                                                                                              • Instruction ID: 5d33ebafa9de3b94086f2c1a51a960f0d13db746ae9e51e314ffbb434252dda8
                                                                                                                                                                                              • Opcode Fuzzy Hash: 5f2b6d7808a3ea70d0b20ab0ed2f5dc32236610a65f1ac5633372f62af129d48
                                                                                                                                                                                              • Instruction Fuzzy Hash: 5AE0BF311005149F87296A1CEC50876B3B5FAA17653104B7BD057D25255B606E45D751
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008DA58E Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                              • Opcode ID: 06f336521bc9338ab3787e6487a636029a9d857d87c082c57f2213e58f23ac54
                                                                                                                                                                                              • Instruction ID: 741ac9973b1b412bc8911b908ce5e54d844d7c367d15a2f6c31652916ad85486
                                                                                                                                                                                              • Opcode Fuzzy Hash: 06f336521bc9338ab3787e6487a636029a9d857d87c082c57f2213e58f23ac54
                                                                                                                                                                                              • Instruction Fuzzy Hash: ECE09AB2C4024EDADB00DFD9C452BEFBBB8FB09310F508566E205E6141EA745744CBA2
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D114D Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 008D115E
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FreeHeap
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3298025750-0
                                                                                                                                                                                              • Opcode ID: 14a37a76217b318adf9c266377575aa91709120b2c2f0047ead277b9a01f0742
                                                                                                                                                                                              • Instruction ID: fdfefd44bb00efd9f115b68250ec9833a11648ac1cb00773aee325e556f50348
                                                                                                                                                                                              • Opcode Fuzzy Hash: 14a37a76217b318adf9c266377575aa91709120b2c2f0047ead277b9a01f0742
                                                                                                                                                                                              • Instruction Fuzzy Hash: 6AC01231000608FACB020E40DC09B957B68BB00704F148021F608184A18372A5A0DA84
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D1138 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(?,00000000,?), ref: 008D1143
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AllocateHeap
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1279760036-0
                                                                                                                                                                                              • Opcode ID: 7d79cae9d31c9df448f6b6b9f658315d50419ad4dafb94e66bbdd1c4e02a3370
                                                                                                                                                                                              • Instruction ID: e66ace285c20985b32a6209483246911815111967d9873264e5548a38d1fb8d9
                                                                                                                                                                                              • Opcode Fuzzy Hash: 7d79cae9d31c9df448f6b6b9f658315d50419ad4dafb94e66bbdd1c4e02a3370
                                                                                                                                                                                              • Instruction Fuzzy Hash: 3DB09232040208FBCA011B81EC06F85BF69EB15B50F10C021F608490628773A421ABA9
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                              Function 008E4198 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: __floor_pentium4
                                                                                                                                                                                              • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                              • API String ID: 4168288129-2761157908
                                                                                                                                                                                              • Opcode ID: f6bf3025c4b9c147da5c97e6e9914bdf52ca0639a7cfad5b1406c7cf10d90785
                                                                                                                                                                                              • Instruction ID: 60a5abc8d0593e26db8ec944338a6b40bb109fb4b4a32d00df43215402fe836f
                                                                                                                                                                                              • Opcode Fuzzy Hash: f6bf3025c4b9c147da5c97e6e9914bdf52ca0639a7cfad5b1406c7cf10d90785
                                                                                                                                                                                              • Instruction Fuzzy Hash: 16D23971E086688FDB65CE29DC407EAB7B5FB46309F1451EAD40DE7240EB78AE818F41
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D324D Relevance: 9.1, APIs: 6, Instructions: 140windowCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetLastError.KERNEL32(?,008D14FB,?,008D14FB), ref: 008D32CE
                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,?,008D14FB,?,008D14FB), ref: 008D32DB
                                                                                                                                                                                              • FormatMessageW.KERNEL32(00000500,00000000,00000000,00000000,00000000,00000000,008D14FB,?,008D14FB,?,008D14FB), ref: 008D32F1
                                                                                                                                                                                              • GetLastError.KERNEL32(?,008D14FB,?,008D14FB), ref: 008D32FB
                                                                                                                                                                                              • SetLastError.KERNEL32(008D14FB,?,008D14FB,?,008D14FB), ref: 008D3308
                                                                                                                                                                                              • LocalFree.KERNEL32(00000000,?,008D14FB,?,008D14FB), ref: 008D33B4
                                                                                                                                                                                                • Part of subcall function 008D29DE: FindResourceExW.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,74DEDFA0,?,?,008D33F9,-00000010,?,?,?,008D14FB), ref: 008D2A0F
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ErrorLast$FindFormatFreeLocalMessageResource
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1240203180-0
                                                                                                                                                                                              • Opcode ID: e152a35c517ffbdaa18e8fbac52472112cdf786e35804d453cbe7d2d0a07a7f0
                                                                                                                                                                                              • Instruction ID: 7d2340c5386dd1bbdfd0357022a7a3ec39d9ec5a6219922007333d6e96b88df9
                                                                                                                                                                                              • Opcode Fuzzy Hash: e152a35c517ffbdaa18e8fbac52472112cdf786e35804d453cbe7d2d0a07a7f0
                                                                                                                                                                                              • Instruction Fuzzy Hash: FC418D75A00208EBDB08EFA9D985AAEB779FF54300F10425AE901D7341DB70AE04DB62
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D6D06 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 008D6D12
                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32 ref: 008D6DDE
                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 008D6DFE
                                                                                                                                                                                              • UnhandledExceptionFilter.KERNEL32(?), ref: 008D6E08
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 254469556-0
                                                                                                                                                                                              • Opcode ID: dcf5b5c56b05cf10afca05c6a96c2ae106099fda97782d9be5f154f71d4e3ebf
                                                                                                                                                                                              • Instruction ID: 0d35e033d715a8147509ce71d226607f2721dd49a36914d5e92faced0131909b
                                                                                                                                                                                              • Opcode Fuzzy Hash: dcf5b5c56b05cf10afca05c6a96c2ae106099fda97782d9be5f154f71d4e3ebf
                                                                                                                                                                                              • Instruction Fuzzy Hash: E9310575D0521CDBDB60DFA4D989BCDBBB8FF08700F1041AAE409AB250EB759A849F45
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008E168D Relevance: 4.8, APIs: 3, Instructions: 337COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID:
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                              • Opcode ID: b0e0bbd5f1d96daac4612cb4a436a56454da5e40dfd1f64c71768d0abb85c165
                                                                                                                                                                                              • Instruction ID: 481f31da0fc904150808c0594e64fd2a3f77e9b3094bb636439890508ea598ee
                                                                                                                                                                                              • Opcode Fuzzy Hash: b0e0bbd5f1d96daac4612cb4a436a56454da5e40dfd1f64c71768d0abb85c165
                                                                                                                                                                                              • Instruction Fuzzy Hash: 0EB14932E042999FDF119F2AC895BEEBFA5FF56314F144166E805EB342D2349D01C7A1
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008DDA04 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000401), ref: 008DDAFC
                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000401), ref: 008DDB06
                                                                                                                                                                                              • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000401), ref: 008DDB13
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3906539128-0
                                                                                                                                                                                              • Opcode ID: a28387215db92d5f0a300704b1689cc49a9357cc0043babafb3fde0c480bb01c
                                                                                                                                                                                              • Instruction ID: 3e6025a780da7d4f8bcd4c00bae13be8163f901df880c8aa8595a8705999847d
                                                                                                                                                                                              • Opcode Fuzzy Hash: a28387215db92d5f0a300704b1689cc49a9357cc0043babafb3fde0c480bb01c
                                                                                                                                                                                              • Instruction Fuzzy Hash: EC31D87591122CDBCB21DF68D888BCDBBB4FF08710F5042DAE41CA6250EB709B859F45
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D11D5 Relevance: 4.6, APIs: 3, Instructions: 53memoryCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetProcessHeap.KERNEL32(?,?,008D2C07,?,008D14FB), ref: 008D1218
                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 008D123F
                                                                                                                                                                                                • Part of subcall function 008E86C5: EnterCriticalSection.KERNEL32(008F43C8,008F4400,?,?,008D120E,008F4400,?,?,008D2C07,?,008D14FB), ref: 008E86D0
                                                                                                                                                                                                • Part of subcall function 008E86C5: LeaveCriticalSection.KERNEL32(008F43C8,?,008D120E,008F4400,?,?,008D2C07,?,008D14FB), ref: 008E870D
                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 008D12A1
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CriticalInit_thread_footerSection$EnterHeapLeaveProcess
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3363689876-0
                                                                                                                                                                                              • Opcode ID: 528f3c5524f03a49a1fb4b36df94843efe6a03711152c43d4b528318065168c8
                                                                                                                                                                                              • Instruction ID: 8ba500ccb4e34ce4a25658f230b5fb1648a31a434d4070f258ad0704098a1e9c
                                                                                                                                                                                              • Opcode Fuzzy Hash: 528f3c5524f03a49a1fb4b36df94843efe6a03711152c43d4b528318065168c8
                                                                                                                                                                                              • Instruction Fuzzy Hash: F4119072506240DBC710DBBDFC49F2A37A0FB62739F20621BE214E62A2CB741446CB6D
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008E3D10 Relevance: 3.4, APIs: 2, Instructions: 449COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID:
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                              • Opcode ID: 5a5de4475321df752b8b9df09e3ac9534813bd07a6e30a606723c2d77483104b
                                                                                                                                                                                              • Instruction ID: 831ea8bd9c92bf3ae72bf284eee0e2e1d1502e24106f8d54898379db4a4e09c2
                                                                                                                                                                                              • Opcode Fuzzy Hash: 5a5de4475321df752b8b9df09e3ac9534813bd07a6e30a606723c2d77483104b
                                                                                                                                                                                              • Instruction Fuzzy Hash: 43F13E71E002599FDF14CFA9C884AADB7B1FF89314F158269E919EB384D730AE41CB90
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008E7A0B Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,008E7A06,?,?,00000008,?,?,008E7610,00000000), ref: 008E7C38
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionRaise
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3997070919-0
                                                                                                                                                                                              • Opcode ID: 06121c99d3cf6a43bb6720e3cc4d0058949e80b142e845f06834faf8f4bcac78
                                                                                                                                                                                              • Instruction ID: ed43154592717ba574364e9f5ccc1ae78d0296878a5568a13fe0cb26634ace9b
                                                                                                                                                                                              • Opcode Fuzzy Hash: 06121c99d3cf6a43bb6720e3cc4d0058949e80b142e845f06834faf8f4bcac78
                                                                                                                                                                                              • Instruction Fuzzy Hash: 9DB15D31614649CFD719CF29C486B657BE0FF46364F258658E89ACF2A1C335EE82CB40
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D6FA5 Relevance: 1.6, APIs: 1, Instructions: 144COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 008D6FBB
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FeaturePresentProcessor
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2325560087-0
                                                                                                                                                                                              • Opcode ID: 2dbe93a97f568da16ec8c3e86636478d2db5c34afe11e0f2b48815d0d63064bd
                                                                                                                                                                                              • Instruction ID: 11fd64d7818fa594d281d3b94a524b44df0caf25547c94c8b75d452c1c0cf7bf
                                                                                                                                                                                              • Opcode Fuzzy Hash: 2dbe93a97f568da16ec8c3e86636478d2db5c34afe11e0f2b48815d0d63064bd
                                                                                                                                                                                              • Instruction Fuzzy Hash: E15148B1A05605DFDB25CF68D885BAEBBF4FB48310F24862AD405EB390E3B59A40CF50
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008DC5D4 Relevance: 1.6, Strings: 1, Instructions: 388COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID:
                                                                                                                                                                                              • String ID: 0
                                                                                                                                                                                              • API String ID: 0-4108050209
                                                                                                                                                                                              • Opcode ID: 60316271159ba222afc5c8895ab83f4bbe8b99aa89d200c915aa44919a2f73b4
                                                                                                                                                                                              • Instruction ID: d8a81e1572990fee133ae164f72518f13e04a8c7b7af54319860d56ccded5152
                                                                                                                                                                                              • Opcode Fuzzy Hash: 60316271159ba222afc5c8895ab83f4bbe8b99aa89d200c915aa44919a2f73b4
                                                                                                                                                                                              • Instruction Fuzzy Hash: F7E17574A0060A8FCB24CF68C590AAEBBB1FF59314B24975EE456DB390D730ED42CB52
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D6E9A Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(Function_00006EA6,008D6812), ref: 008D6E9F
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3192549508-0
                                                                                                                                                                                              • Opcode ID: e49f7969fa78d67ea169027721b8468d21c482c8c96d647b2e320c1db4b1c002
                                                                                                                                                                                              • Instruction ID: 35d23efc6c2c8d90af82da4bc3c69ca60abf397b3e3df317670de990c50908be
                                                                                                                                                                                              • Opcode Fuzzy Hash: e49f7969fa78d67ea169027721b8468d21c482c8c96d647b2e320c1db4b1c002
                                                                                                                                                                                              • Instruction Fuzzy Hash:
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D5AB6 Relevance: .5, Instructions: 502COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID:
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                              • Opcode ID: 07742bc48a47d668c5b7ba0a761fa324f4e69b4b27f22652eb96e8f34f5a8860
                                                                                                                                                                                              • Instruction ID: 9fca35e53f28cd9edc20021ea03565c89aca1cf1c2808867a69adcc20f53cbd2
                                                                                                                                                                                              • Opcode Fuzzy Hash: 07742bc48a47d668c5b7ba0a761fa324f4e69b4b27f22652eb96e8f34f5a8860
                                                                                                                                                                                              • Instruction Fuzzy Hash: 59026E72E0052D8FDB18DB69C4846BCBBF2FB84385F154667E456EB384E6349E81CB90
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008DF38C Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID:
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                              • Opcode ID: 16ebe579c643b41b3b2ed50db8f55ad19555c0db4d7538cbefb163680043b31e
                                                                                                                                                                                              • Instruction ID: 75db05eda272d25d6041f7e03570cb68e8e132456f0872ded9fa3eea78a86594
                                                                                                                                                                                              • Opcode Fuzzy Hash: 16ebe579c643b41b3b2ed50db8f55ad19555c0db4d7538cbefb163680043b31e
                                                                                                                                                                                              • Instruction Fuzzy Hash: 13E04632911268EBCB19DB8CD90498AB3ACFB45B04B5245A6B602D3201C270DE00DBD0
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008DA026 Relevance: .0, Instructions: 12COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID:
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                              • Opcode ID: 07b441ad80737fae624cd0199c2363617cbbe7bd83f795c05ac74d04cb32a94c
                                                                                                                                                                                              • Instruction ID: 4f93def21a12cca179704dd5ebf44bbcd5b0d2e6ff5b1776171c1203f69e93c9
                                                                                                                                                                                              • Opcode Fuzzy Hash: 07b441ad80737fae624cd0199c2363617cbbe7bd83f795c05ac74d04cb32a94c
                                                                                                                                                                                              • Instruction Fuzzy Hash: D2C08C34000D00CACE2D8D1882713A63354F391BC2FA0068EC903CB742C95FAC86E602
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008E85DD Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • InitializeCriticalSectionAndSpinCount.KERNEL32(008F43C8,00000FA0,?,?,008E85BB), ref: 008E85E9
                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,008E85BB), ref: 008E85F4
                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,008E85BB), ref: 008E8605
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 008E8617
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 008E8625
                                                                                                                                                                                              • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,008E85BB), ref: 008E8648
                                                                                                                                                                                              • DeleteCriticalSection.KERNEL32(008F43C8,00000007,?,?,008E85BB), ref: 008E8664
                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,008E85BB), ref: 008E8674
                                                                                                                                                                                              Strings
                                                                                                                                                                                              • WakeAllConditionVariable, xrefs: 008E861D
                                                                                                                                                                                              • kernel32.dll, xrefs: 008E8600
                                                                                                                                                                                              • SleepConditionVariableCS, xrefs: 008E8611
                                                                                                                                                                                              • api-ms-win-core-synch-l1-2-0.dll, xrefs: 008E85EF
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                                              • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                                              • API String ID: 2565136772-3242537097
                                                                                                                                                                                              • Opcode ID: ff29e98ad93ab6b64019d8355d9825f1f95882cadbd439e806cb23bade876e91
                                                                                                                                                                                              • Instruction ID: c7528d63a8d23c3270dbe3593efb442665e679e8bc8b5690a7583ae100f8a86f
                                                                                                                                                                                              • Opcode Fuzzy Hash: ff29e98ad93ab6b64019d8355d9825f1f95882cadbd439e806cb23bade876e91
                                                                                                                                                                                              • Instruction Fuzzy Hash: 4B012830A40B91DBC7245BB6AC4DE2B3AA8FBA2F517011026FA19D6360DF74D800C622
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D89AB Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • IsInExceptionSpec.LIBVCRUNTIME ref: 008D8AA8
                                                                                                                                                                                              • type_info::operator==.LIBVCRUNTIME ref: 008D8ACA
                                                                                                                                                                                              • ___TypeMatch.LIBVCRUNTIME ref: 008D8BD9
                                                                                                                                                                                              • IsInExceptionSpec.LIBVCRUNTIME ref: 008D8CAB
                                                                                                                                                                                              • _UnwindNestedFrames.LIBCMT ref: 008D8D2F
                                                                                                                                                                                              • CallUnexpected.LIBVCRUNTIME ref: 008D8D4A
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                              • API String ID: 2123188842-393685449
                                                                                                                                                                                              • Opcode ID: 37f306b46dc2c71840824b000036de82f23748c681e9f0c7bd327dc570902869
                                                                                                                                                                                              • Instruction ID: 41d87c17a9b831a161a08ac630c7d1d11228e19c57e8e3487df494988efba995
                                                                                                                                                                                              • Opcode Fuzzy Hash: 37f306b46dc2c71840824b000036de82f23748c681e9f0c7bd327dc570902869
                                                                                                                                                                                              • Instruction Fuzzy Hash: 1BB15A71801219EFCF29DFA8C8819AEB7B5FF14310B15425BE811EB352DB35DA51CBA2
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D73D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 008D7407
                                                                                                                                                                                              • ___except_validate_context_record.LIBVCRUNTIME ref: 008D740F
                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 008D7498
                                                                                                                                                                                              • __IsNonwritableInCurrentImage.LIBCMT ref: 008D74C3
                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 008D7518
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                              • API String ID: 1170836740-1018135373
                                                                                                                                                                                              • Opcode ID: fa5e5ba548d7f90a54e315cb22bce1bf25c63b276cadfe744d7c88f20afe6648
                                                                                                                                                                                              • Instruction ID: ab9052afefa5482c3f3a6cb03a116019d57f887c711dec756dba6e8ade2c4d75
                                                                                                                                                                                              • Opcode Fuzzy Hash: fa5e5ba548d7f90a54e315cb22bce1bf25c63b276cadfe744d7c88f20afe6648
                                                                                                                                                                                              • Instruction Fuzzy Hash: FD41D634A04219ABCF11DF6CC880A9E7FB5FF45324F548256E814EB352E735AA45CB91
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008E031F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,FFFFFEAF,?,30CA9840,?,008E042C,008DBD16,?,FFFFFEAF,00000000), ref: 008E03E0
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FreeLibrary
                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                              • API String ID: 3664257935-537541572
                                                                                                                                                                                              • Opcode ID: e873979e411767912eb073b88bf308fec2dce84c35db42028c4a679b03e2f75c
                                                                                                                                                                                              • Instruction ID: 46d0a794db76ffb9e1a2a1908e4a1b33bde1eaa998e43192780bbaf88e8f40db
                                                                                                                                                                                              • Opcode Fuzzy Hash: e873979e411767912eb073b88bf308fec2dce84c35db42028c4a679b03e2f75c
                                                                                                                                                                                              • Instruction Fuzzy Hash: 4A210831A05754ABC721DB26DC80A5B3768FB437A5B210911F855EB390E770ED40CED1
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D3A75 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • lstrcpynW.KERNEL32(?,?,00000104,?,?), ref: 008D3A99
                                                                                                                                                                                              • PathStripPathW.SHLWAPI(?,?,00000104,?,?), ref: 008D3AA6
                                                                                                                                                                                              • PathRemoveExtensionW.SHLWAPI(?,?,00000104,?,?), ref: 008D3AB3
                                                                                                                                                                                              • lstrlenW.KERNEL32(?,?,00000104,?,?), ref: 008D3AC6
                                                                                                                                                                                              • lstrlenW.KERNEL32(?,?,00000104,?,?), ref: 008D3ADC
                                                                                                                                                                                              • lstrlenW.KERNEL32(?,?,00000104,?,?), ref: 008D3B42
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Pathlstrlen$ExtensionRemoveStriplstrcpyn
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2958138087-0
                                                                                                                                                                                              • Opcode ID: 3416c0c0540f05327098279e72b591c187d45d921d4af5ea96f90f4cd8b81ba2
                                                                                                                                                                                              • Instruction ID: abc0d40b4ad4871e71974407790bae03e61c20b79d71867ed3d6de0269ed0952
                                                                                                                                                                                              • Opcode Fuzzy Hash: 3416c0c0540f05327098279e72b591c187d45d921d4af5ea96f90f4cd8b81ba2
                                                                                                                                                                                              • Instruction Fuzzy Hash: 592191B590121C9ACF24EB78DC48AED77B8FB40324F2047A7D426D7255EB709B85CB42
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D7A81 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,008D7A78,008D774C,008D6EEA), ref: 008D7A8F
                                                                                                                                                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 008D7A9D
                                                                                                                                                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 008D7AB6
                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,008D7A78,008D774C,008D6EEA), ref: 008D7B08
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3852720340-0
                                                                                                                                                                                              • Opcode ID: d9c48090f774cb3146df0ddafbef14c7371f8b8087fcafb6b7a859fe8e2b5024
                                                                                                                                                                                              • Instruction ID: 0b6c030a2a773bdbd92509bf6e3aaffa4cdf9b63d046a882fbd6831fecd6992c
                                                                                                                                                                                              • Opcode Fuzzy Hash: d9c48090f774cb3146df0ddafbef14c7371f8b8087fcafb6b7a859fe8e2b5024
                                                                                                                                                                                              • Instruction Fuzzy Hash: 6801D43260D7216EA6142778AC85D7A2B65FB45774730033BF520D43F0FF518D059655
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008DE65C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              Strings
                                                                                                                                                                                              • C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe, xrefs: 008DE678
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID:
                                                                                                                                                                                              • String ID: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                              • API String ID: 0-3497388283
                                                                                                                                                                                              • Opcode ID: 6337d62c657977add8fceca4571a43ed4a136e68a047a8a43a67f373f5a5386f
                                                                                                                                                                                              • Instruction ID: c0f72260b9c727a4d67589c9e3ed84241cce725d9fabacf97bd6cc838f32b887
                                                                                                                                                                                              • Opcode Fuzzy Hash: 6337d62c657977add8fceca4571a43ed4a136e68a047a8a43a67f373f5a5386f
                                                                                                                                                                                              • Instruction Fuzzy Hash: D6215871604709AF9B60BF6AD88086A77ADFF60368B104726F819DB351EB30EC40C7A1
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D7C03 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,008D7CC4,?,?,008F3CF8,00000000,?,008D7DEF,00000004,InitializeCriticalSectionEx,008EACD4,InitializeCriticalSectionEx,00000000), ref: 008D7C93
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FreeLibrary
                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                              • API String ID: 3664257935-2084034818
                                                                                                                                                                                              • Opcode ID: d76d82f7464864a107a003fb92ea3ec395000600a9ec85b6aa239c8d856a8bd1
                                                                                                                                                                                              • Instruction ID: b6b518539b3c61728d304c104a220fa5fb34b2c6e612be69eac7aa55f0744dbc
                                                                                                                                                                                              • Opcode Fuzzy Hash: d76d82f7464864a107a003fb92ea3ec395000600a9ec85b6aa239c8d856a8bd1
                                                                                                                                                                                              • Instruction Fuzzy Hash: 5111A332A55725EFDB228B689C45B5933A4FF41BB4F250312E915EB390F760FD0086D2
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008DA048 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,30CA9840,?,?,00000000,008E9C93,000000FF,?,008DA01B,008DA108,?,008D9FEF,00000000), ref: 008DA07D
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 008DA08F
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,00000000,008E9C93,000000FF,?,008DA01B,008DA108,?,008D9FEF,00000000), ref: 008DA0B1
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                              • Opcode ID: 3ae249350a233f3bb78420f694b27ae2df4a5a41272642cb523f102e7cff7474
                                                                                                                                                                                              • Instruction ID: 7871b09dedfe63e7032bdf434aa0f2b453bc188cbf7fa92c4846e17bb57c4254
                                                                                                                                                                                              • Opcode Fuzzy Hash: 3ae249350a233f3bb78420f694b27ae2df4a5a41272642cb523f102e7cff7474
                                                                                                                                                                                              • Instruction Fuzzy Hash: 8601A731A40A55EFCB159F51CC05FAE7BB8FB44B11F000625E821E2790DB78A904CA82
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008E29A4 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • __alloca_probe_16.LIBCMT ref: 008E2A2B
                                                                                                                                                                                              • __alloca_probe_16.LIBCMT ref: 008E2AEC
                                                                                                                                                                                              • __freea.LIBCMT ref: 008E2B53
                                                                                                                                                                                                • Part of subcall function 008DFAE8: RtlAllocateHeap.NTDLL(00000000,008DEBDC,?,?,008DEBDC,00000220,?,?,?), ref: 008DFB1A
                                                                                                                                                                                              • __freea.LIBCMT ref: 008E2B68
                                                                                                                                                                                              • __freea.LIBCMT ref: 008E2B78
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: __freea$__alloca_probe_16$AllocateHeap
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1423051803-0
                                                                                                                                                                                              • Opcode ID: cd9f631ffefb594f429a7cb86e632284e0c94b94efe73699ff300fb934835cdc
                                                                                                                                                                                              • Instruction ID: f419eef980ee5f398b82b164c20272e22186ebe931dda69487223dc76f004f9a
                                                                                                                                                                                              • Opcode Fuzzy Hash: cd9f631ffefb594f429a7cb86e632284e0c94b94efe73699ff300fb934835cdc
                                                                                                                                                                                              • Instruction Fuzzy Hash: 5551B37260029AAFDB219F668C41EBB37ADFB46324B140239FD19D7251EB70CC509761
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D1CDF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,00000000,00000000,00000000), ref: 008D1D75
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FileModuleName
                                                                                                                                                                                              • String ID: "%s"$/%s$recover
                                                                                                                                                                                              • API String ID: 514040917-4067204065
                                                                                                                                                                                              • Opcode ID: 45ac3506b97a9efb71f18de75d8703f9a701f23914b568ff6018899765e692b6
                                                                                                                                                                                              • Instruction ID: ab0d8fec62530a85cf4e5a0b5a59aa6bcca3650c010405df7449535eeabe70d2
                                                                                                                                                                                              • Opcode Fuzzy Hash: 45ac3506b97a9efb71f18de75d8703f9a701f23914b568ff6018899765e692b6
                                                                                                                                                                                              • Instruction Fuzzy Hash: 3E11487194021CA6CF20EB65DC89ED97779FF25710F1005A7A919D7282DB709A44CB91
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008E2E70 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetConsoleOutputCP.KERNEL32(30CA9840,?,00000000,008F18B8), ref: 008E2ED3
                                                                                                                                                                                                • Part of subcall function 008DF15E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,008E2B49,?,00000000,-00000008), ref: 008DF20A
                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 008E312E
                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 008E3176
                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 008E3219
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2112829910-0
                                                                                                                                                                                              • Opcode ID: 033fe4c066cc887320b91776d92e9bbf683a84ca6c2aa8497baad4c67271cce4
                                                                                                                                                                                              • Instruction ID: 51d0ac4aa8906032a5fb81752d96bad523fe4887a4e664bfbadc350ecacadcfb
                                                                                                                                                                                              • Opcode Fuzzy Hash: 033fe4c066cc887320b91776d92e9bbf683a84ca6c2aa8497baad4c67271cce4
                                                                                                                                                                                              • Instruction Fuzzy Hash: B3D18BB5E00688AFCF15CFE9D8849ADBBB4FF4A304F18412AE965E7341D730A946CB50
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D8754 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AdjustPointer
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1740715915-0
                                                                                                                                                                                              • Opcode ID: 67dab8d2f6db6ce2b58dfe00665bddfbb12622a9de131e2619fae4d1152ee327
                                                                                                                                                                                              • Instruction ID: b2c6cda8946bb5a86a6c1818586dd556fa44f880e3218b664e680b7a4903116e
                                                                                                                                                                                              • Opcode Fuzzy Hash: 67dab8d2f6db6ce2b58dfe00665bddfbb12622a9de131e2619fae4d1152ee327
                                                                                                                                                                                              • Instruction Fuzzy Hash: C851BE72600606EFDB299F18D841B6A77B5FF44710F64472BE802D73A1EB31E940E792
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008DDE72 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                                • Part of subcall function 008DF15E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,008E2B49,?,00000000,-00000008), ref: 008DF20A
                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 008DDED6
                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 008DDEDD
                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?), ref: 008DDF17
                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 008DDF1E
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ErrorLast__dosmaperr$ByteCharMultiWide
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1913693674-0
                                                                                                                                                                                              • Opcode ID: c88e5dcccb7ad9c124bc279ac62105adeb10b2cce0b99c402f9d315195238386
                                                                                                                                                                                              • Instruction ID: 8c17b4d681e55e9619c4fe3d2209ed687721fe516b71dcccf06a295f055ffa12
                                                                                                                                                                                              • Opcode Fuzzy Hash: c88e5dcccb7ad9c124bc279ac62105adeb10b2cce0b99c402f9d315195238386
                                                                                                                                                                                              • Instruction Fuzzy Hash: 0B218371615705AFDB20AF6AD88086BB7ADFF10364711871AF91ADB350EB71EC40C751
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008DF24C Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetEnvironmentStringsW.KERNEL32 ref: 008DF254
                                                                                                                                                                                                • Part of subcall function 008DF15E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,008E2B49,?,00000000,-00000008), ref: 008DF20A
                                                                                                                                                                                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008DF28C
                                                                                                                                                                                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008DF2AC
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 158306478-0
                                                                                                                                                                                              • Opcode ID: abc63824b4dff22dbdee2d65227f0f66845e760ef8980a2c55e03edf71f272a8
                                                                                                                                                                                              • Instruction ID: 135fb8f761bdecf328a4422b238e18095756363056e2d6596f2eb8f1a87bd645
                                                                                                                                                                                              • Opcode Fuzzy Hash: abc63824b4dff22dbdee2d65227f0f66845e760ef8980a2c55e03edf71f272a8
                                                                                                                                                                                              • Instruction Fuzzy Hash: E11104A6901619BF6B2127B55CCEC7F3B6CFE457A87100237F607D7302EA649D00A6B2
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D1444 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 008D14A3
                                                                                                                                                                                              • VerSetConditionMask.KERNEL32(00000000), ref: 008D14A7
                                                                                                                                                                                              • VerSetConditionMask.KERNEL32(00000000), ref: 008D14AB
                                                                                                                                                                                              • VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 008D14CF
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ConditionMask$InfoVerifyVersion
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2793162063-0
                                                                                                                                                                                              • Opcode ID: ae4234880ef432ba05ce9384c2614e54928d978f6bc3f8acb405ff3fba350d60
                                                                                                                                                                                              • Instruction ID: bae9db06e1803f36e3fb097994c5d58962df73916b7ed27fdfbabba45d5cb453
                                                                                                                                                                                              • Opcode Fuzzy Hash: ae4234880ef432ba05ce9384c2614e54928d978f6bc3f8acb405ff3fba350d60
                                                                                                                                                                                              • Instruction Fuzzy Hash: 2D111670A403187AEB21DB65DC4AFEFBBBCEF85B10F00045AA504E62C0DAB45B448A95
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008E65B6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • WriteConsoleW.KERNEL32(?,008F18B8,00000000,00000000,?,?,008E5930,?,00000001,?,008F18B8,?,008E326D,008F18B8,?,00000000), ref: 008E65CD
                                                                                                                                                                                              • GetLastError.KERNEL32(?,008E5930,?,00000001,?,008F18B8,?,008E326D,008F18B8,?,00000000,008F18B8,008F18B8,?,008E37F4,?), ref: 008E65D9
                                                                                                                                                                                                • Part of subcall function 008E659F: CloseHandle.KERNEL32(FFFFFFFE,008E65E9,?,008E5930,?,00000001,?,008F18B8,?,008E326D,008F18B8,?,00000000,008F18B8,008F18B8), ref: 008E65AF
                                                                                                                                                                                              • ___initconout.LIBCMT ref: 008E65E9
                                                                                                                                                                                                • Part of subcall function 008E6561: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,008E6590,008E591D,008F18B8,?,008E326D,008F18B8,?,00000000,008F18B8), ref: 008E6574
                                                                                                                                                                                              • WriteConsoleW.KERNEL32(?,008F18B8,00000000,00000000,?,008E5930,?,00000001,?,008F18B8,?,008E326D,008F18B8,?,00000000,008F18B8), ref: 008E65FE
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2744216297-0
                                                                                                                                                                                              • Opcode ID: 833758b05d2dc4304ca86fa6b614430191c482e81f7d433402af823309429ed3
                                                                                                                                                                                              • Instruction ID: e7dbfd6a85a094fed1c7d2258caf5bf07a6d603a825b25d81f4841f06edab214
                                                                                                                                                                                              • Opcode Fuzzy Hash: 833758b05d2dc4304ca86fa6b614430191c482e81f7d433402af823309429ed3
                                                                                                                                                                                              • Instruction Fuzzy Hash: 8CF01C36110198BBCF622F9ADC4899D3F66FB2A7E0F014020FA29C5130E6329920EB91
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008E874D Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • SleepConditionVariableCS.KERNELBASE(?,008E86EA,00000064), ref: 008E8770
                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(008F43C8,?,?,008E86EA,00000064,?,008D120E,008F4400,?,?,008D2C07,?,008D14FB), ref: 008E877A
                                                                                                                                                                                              • WaitForSingleObjectEx.KERNEL32(?,00000000,?,008E86EA,00000064,?,008D120E,008F4400,?,?,008D2C07,?,008D14FB), ref: 008E878B
                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(008F43C8,?,008E86EA,00000064,?,008D120E,008F4400,?,?,008D2C07,?,008D14FB), ref: 008E8792
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3269011525-0
                                                                                                                                                                                              • Opcode ID: cdef9e700d4f478b5303b7c61bc3879e0d60764b5036d453736b68428a9535c6
                                                                                                                                                                                              • Instruction ID: e8c5c6c9e935f3c0e3d0bf786e5826bed55c6e1d9ecc4af62ab789f262c9741d
                                                                                                                                                                                              • Opcode Fuzzy Hash: cdef9e700d4f478b5303b7c61bc3879e0d60764b5036d453736b68428a9535c6
                                                                                                                                                                                              • Instruction Fuzzy Hash: F4E01B35541668F7C7051BA1EC45D6F3F65FB05F62B051115FB05E6360C77519009BD1
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008D8D55 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 008D8D7A
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: EncodePointer
                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                              • API String ID: 2118026453-2084237596
                                                                                                                                                                                              • Opcode ID: cdfaf75e8a6cfac3c7f042cb1d9d9a7ef522f8f00240a8384bdde97ed7aa30eb
                                                                                                                                                                                              • Instruction ID: cae1b5ea931a1b01ba76ede9119954231ce9fe5d86f6ac605fa13eb5e6cc3d90
                                                                                                                                                                                              • Opcode Fuzzy Hash: cdfaf75e8a6cfac3c7f042cb1d9d9a7ef522f8f00240a8384bdde97ed7aa30eb
                                                                                                                                                                                              • Instruction Fuzzy Hash: DF413671900209EFCF15DF98C881AEEBBB6FF48300F19829AF904A7261DB35A950DF51
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 008E7FD1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                                • Part of subcall function 008D1097: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 008D109C
                                                                                                                                                                                                • Part of subcall function 008D1097: GetLastError.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 008D10A6
                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32(?,?,?,008D100A), ref: 008E8004
                                                                                                                                                                                              • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,008D100A), ref: 008E8013
                                                                                                                                                                                              Strings
                                                                                                                                                                                              • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 008E800E
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000000.00000002.2424096802.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000000.00000002.2423987309.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424534177.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424740131.00000000008F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000000.00000002.2424841572.00000000008F5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_8d0000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                                                                                                                              • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                              • API String ID: 450123788-631824599
                                                                                                                                                                                              • Opcode ID: f6a71f2f2325daa4ddbab5f1d0da3a37bec74fe720f5f833fbff01a43729d65b
                                                                                                                                                                                              • Instruction ID: d4d7d5bc294ce4bb60c179def82d492a6222a484c40fbe0ccb7340f872ffbbeb
                                                                                                                                                                                              • Opcode Fuzzy Hash: f6a71f2f2325daa4ddbab5f1d0da3a37bec74fe720f5f833fbff01a43729d65b
                                                                                                                                                                                              • Instruction Fuzzy Hash: 0DE03970200B80CAE3709F6AE80474A7BE4FB05714F00891DE49AC6641DBB5A4488BA2
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                              Execution Coverage:3.2%
                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                              Signature Coverage:0.6%
                                                                                                                                                                                              Total number of Nodes:1993
                                                                                                                                                                                              Total number of Limit Nodes:24
                                                                                                                                                                                              execution_graph 9201 3dc8bd 9202 3dd52b __freea 14 API calls 9201->9202 9203 3dc8cb 9202->9203 9204 3dd52b __freea 14 API calls 9203->9204 9205 3dc8de 9204->9205 9206 3dd52b __freea 14 API calls 9205->9206 9207 3dc8ef 9206->9207 9208 3dd52b __freea 14 API calls 9207->9208 9209 3dc900 9208->9209 8334 3dad3f 8337 3db2b7 8334->8337 8338 3dad4e 8337->8338 8339 3db2c4 8337->8339 8341 3dbb0b 8339->8341 8342 3dd52b __freea 14 API calls 8341->8342 8343 3dbb23 8342->8343 8343->8338 8344 3e453b 8345 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 8344->8345 8346 3e454f 8345->8346 8347 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 8346->8347 8348 3e4559 8347->8348 8349 3da53a 8350 3da551 8349->8350 8351 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 8350->8351 8352 3da556 CallCatchBlock 8351->8352 8355 3da419 8352->8355 8354 3da58b __InternalCxxFrameHandler ___AdjustPointer 8357 3da425 CallCatchBlock 8355->8357 8356 3da4a0 __InternalCxxFrameHandler ___AdjustPointer 8356->8354 8357->8356 8358 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 8357->8358 8359 3da556 CallCatchBlock 8358->8359 8360 3da419 __InternalCxxFrameHandler 41 API calls 8359->8360 8361 3da58b __InternalCxxFrameHandler ___AdjustPointer 8360->8361 8361->8354 8362 3d7a3a 8363 3d7d04 __FrameHandler3::FrameUnwindToState GetModuleHandleW 8362->8363 8364 3d7a42 8363->8364 8365 3d7a78 8364->8365 8366 3d7a46 8364->8366 8367 3dbfc9 __FrameHandler3::FrameUnwindToState 23 API calls 8365->8367 8368 3d7a51 8366->8368 8371 3dbfab 8366->8371 8369 3d7a80 8367->8369 8372 3dbe30 __FrameHandler3::FrameUnwindToState 23 API calls 8371->8372 8373 3dbfb6 8372->8373 8373->8368 8374 3dc934 8377 3dc525 8374->8377 8376 3dc939 8378 3dc531 __EH_prolog3 8377->8378 8387 3dc4ef 8378->8387 8385 3dc4c0 14 API calls 8386 3dc568 __FrameHandler3::FrameUnwindToState 8385->8386 8386->8376 8388 3dc507 8387->8388 8389 3dc501 8387->8389 8391 3dc50a 8388->8391 8390 3dc4c0 14 API calls 8389->8390 8390->8388 8392 3dc51c 8391->8392 8393 3dc522 8391->8393 8394 3dc4c0 14 API calls 8392->8394 8395 3dc4c0 8393->8395 8394->8393 8396 3dc4cd 8395->8396 8400 3dc4ea 8395->8400 8397 3dc4e4 8396->8397 8398 3dd52b __freea 14 API calls 8396->8398 8399 3dd52b __freea 14 API calls 8397->8399 8398->8396 8399->8400 8400->8385 9210 3d97b0 9211 3d97ce CallCatchBlock 9210->9211 9222 3d9770 9211->9222 9223 3d978f 9222->9223 9224 3d9782 9222->9224 9225 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 9224->9225 9225->9223 8401 3e2a30 8404 3e2a4e 8401->8404 8403 3e2a46 8405 3e2a53 8404->8405 8408 3e2ae8 8405->8408 8409 3e3313 8405->8409 8408->8403 8410 3e3336 8409->8410 8411 3e3326 DecodePointer 8409->8411 8412 3e3365 8410->8412 8413 3e2c7f 8410->8413 8414 3e337a 8410->8414 8411->8410 8412->8413 8415 3dbaf8 ___std_exception_copy 14 API calls 8412->8415 8413->8403 8414->8413 8416 3dbaf8 ___std_exception_copy 14 API calls 8414->8416 8415->8413 8416->8413 9226 3dd9b3 9227 3dd9de 9226->9227 9228 3dda2c FindFirstFileExW 9227->9228 9229 3dda0d 9227->9229 9228->9229 9233 3dda63 9228->9233 9230 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 9229->9230 9232 3ddb27 9230->9232 9231 3ddac1 FindNextFileW 9231->9233 9234 3ddad6 9231->9234 9233->9231 9235 3ddb0d FindClose 9233->9235 9236 3ddaea FindClose 9234->9236 9239 3e0690 9234->9239 9235->9229 9236->9229 9240 3e06ca 9239->9240 9241 3dbaf8 ___std_exception_copy 14 API calls 9240->9241 9246 3e06de 9240->9246 9242 3e06d3 9241->9242 9243 3dba3a ___std_exception_copy 41 API calls 9242->9243 9243->9246 9244 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 9245 3ddb08 9244->9245 9245->9236 9246->9244 8417 3dae32 8424 3d9b24 8417->8424 8419 3dae3a __FrameHandler3::FrameUnwindToState 8437 3db001 8419->8437 8421 3daeab 8446 3daee4 8421->8446 8423 3daecc 8455 3d9b32 8424->8455 8426 3d9b29 8426->8419 8469 3deeb2 8426->8469 8429 3dcd46 8431 3dcd50 IsProcessorFeaturePresent 8429->8431 8432 3dcd6f 8429->8432 8433 3dcd5c 8431->8433 8434 3dbfc9 __FrameHandler3::FrameUnwindToState 23 API calls 8432->8434 8436 3db83e __FrameHandler3::FrameUnwindToState 8 API calls 8433->8436 8435 3dcd79 8434->8435 8436->8432 8438 3db00d __FrameHandler3::FrameUnwindToState CallCatchBlock 8437->8438 8439 3d9b24 CallCatchBlock 51 API calls 8438->8439 8445 3db028 __CallSettingFrame@12 __FrameHandler3::FrameUnwindToState 8439->8445 8440 3db0a8 8442 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 8440->8442 8444 3db0ad __FrameHandler3::FrameUnwindToState 8440->8444 8443 3db0e8 8442->8443 8444->8421 8445->8440 8522 3db0cf 8445->8522 8527 3da2fe 8446->8527 8448 3daef5 8449 3d9b24 CallCatchBlock 51 API calls 8448->8449 8450 3daefb 8449->8450 8451 3d9b24 CallCatchBlock 51 API calls 8450->8451 8452 3daf06 8451->8452 8454 3daf47 __InternalCxxFrameHandler 8452->8454 8546 3d9a14 8452->8546 8454->8423 8456 3d9b3e GetLastError 8455->8456 8457 3d9b3b 8455->8457 8499 3d9f70 8456->8499 8457->8426 8460 3d9b72 8461 3d9bb8 SetLastError 8460->8461 8461->8426 8462 3d9fab ___vcrt_FlsSetValue 6 API calls 8463 3d9b6c CallCatchBlock 8462->8463 8463->8460 8464 3d9b94 8463->8464 8465 3d9fab ___vcrt_FlsSetValue 6 API calls 8463->8465 8466 3d9fab ___vcrt_FlsSetValue 6 API calls 8464->8466 8467 3d9ba8 8464->8467 8465->8464 8466->8467 8468 3dbb0b ___std_exception_destroy 14 API calls 8467->8468 8468->8460 8504 3dede4 8469->8504 8472 3deef7 8473 3def03 CallCatchBlock 8472->8473 8474 3dd391 __FrameHandler3::FrameUnwindToState 14 API calls 8473->8474 8478 3def30 __FrameHandler3::FrameUnwindToState 8473->8478 8481 3def2a __FrameHandler3::FrameUnwindToState 8473->8481 8474->8481 8475 3def77 8477 3dbaf8 ___std_exception_copy 14 API calls 8475->8477 8476 3def61 8476->8429 8479 3def7c 8477->8479 8480 3defa3 8478->8480 8515 3dd642 EnterCriticalSection 8478->8515 8482 3dba3a ___std_exception_copy 41 API calls 8479->8482 8485 3defe5 8480->8485 8486 3df0d6 8480->8486 8497 3df014 8480->8497 8481->8475 8481->8476 8481->8478 8482->8476 8492 3dd240 _unexpected 41 API calls 8485->8492 8485->8497 8487 3df0e1 8486->8487 8520 3dd68a LeaveCriticalSection 8486->8520 8490 3dbfc9 __FrameHandler3::FrameUnwindToState 23 API calls 8487->8490 8491 3df0e9 8490->8491 8493 3df009 8492->8493 8495 3dd240 _unexpected 41 API calls 8493->8495 8494 3dd240 _unexpected 41 API calls 8496 3df069 8494->8496 8495->8497 8496->8476 8498 3dd240 _unexpected 41 API calls 8496->8498 8516 3df083 8497->8516 8498->8476 8500 3d9eb1 ___vcrt_FlsSetValue 5 API calls 8499->8500 8501 3d9f8a 8500->8501 8502 3d9fa2 TlsGetValue 8501->8502 8503 3d9b53 8501->8503 8502->8503 8503->8460 8503->8461 8503->8462 8505 3dedf0 CallCatchBlock 8504->8505 8510 3dd642 EnterCriticalSection 8505->8510 8507 3dedfe 8511 3dee3c 8507->8511 8510->8507 8514 3dd68a LeaveCriticalSection 8511->8514 8513 3dcd3b 8513->8429 8513->8472 8514->8513 8515->8480 8517 3df089 8516->8517 8518 3df05a 8516->8518 8521 3dd68a LeaveCriticalSection 8517->8521 8518->8476 8518->8494 8518->8496 8520->8487 8521->8518 8523 3d9b24 CallCatchBlock 51 API calls 8522->8523 8524 3db0d4 8523->8524 8525 3db0df 8524->8525 8526 3d9b24 CallCatchBlock 51 API calls 8524->8526 8525->8440 8526->8525 8528 3d9b24 CallCatchBlock 51 API calls 8527->8528 8529 3da307 8528->8529 8530 3da31d 8529->8530 8531 3da30f 8529->8531 8532 3d9b24 CallCatchBlock 51 API calls 8530->8532 8533 3d9b24 CallCatchBlock 51 API calls 8531->8533 8535 3da322 8532->8535 8534 3da317 8533->8534 8534->8448 8535->8534 8536 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 8535->8536 8537 3da345 8536->8537 8538 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 8537->8538 8539 3da35a 8538->8539 8540 3da365 8539->8540 8549 3dabde 8539->8549 8540->8448 8543 3da3b4 8559 3da130 8543->8559 8547 3d9b24 CallCatchBlock 51 API calls 8546->8547 8548 3d9a1c 8547->8548 8548->8454 8550 3dabec ___except_validate_context_record 8549->8550 8551 3d9b24 CallCatchBlock 51 API calls 8550->8551 8552 3dabf2 8551->8552 8553 3dac57 8552->8553 8554 3dac31 8552->8554 8557 3da39d 8552->8557 8553->8557 8566 3da670 8553->8566 8554->8557 8563 3dafe9 8554->8563 8557->8543 8558 3da256 RtlUnwind 8557->8558 8558->8543 8560 3da140 8559->8560 8561 3da152 CallCatchBlock 8559->8561 8560->8540 8562 3d9b24 CallCatchBlock 51 API calls 8561->8562 8562->8560 8564 3db001 __FrameHandler3::FrameUnwindToState 51 API calls 8563->8564 8565 3daffc 8564->8565 8565->8557 8570 3da690 __FrameHandler3::FrameUnwindToState 8566->8570 8567 3da9a8 8568 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 8567->8568 8577 3da9ae 8567->8577 8569 3daa19 8568->8569 8570->8567 8572 3da772 8570->8572 8575 3d9b24 CallCatchBlock 51 API calls 8570->8575 8571 3da97d 8571->8567 8592 3da97b 8571->8592 8636 3daa1a 8571->8636 8572->8571 8573 3da7fb 8572->8573 8614 3da778 type_info::operator== 8572->8614 8581 3da913 __InternalCxxFrameHandler 8573->8581 8621 3da063 8573->8621 8574 3d9b24 CallCatchBlock 51 API calls 8574->8567 8578 3da6f2 8575->8578 8577->8557 8578->8577 8580 3d9b24 CallCatchBlock 51 API calls 8578->8580 8582 3da700 8580->8582 8583 3da96c 8581->8583 8584 3da957 8581->8584 8581->8592 8585 3d9b24 CallCatchBlock 51 API calls 8582->8585 8587 3db0e9 IsInExceptionSpec 41 API calls 8583->8587 8586 3d9b24 CallCatchBlock 51 API calls 8584->8586 8593 3da708 8585->8593 8588 3da95c 8586->8588 8589 3da975 8587->8589 8590 3d9b24 CallCatchBlock 51 API calls 8588->8590 8591 3da9d8 8589->8591 8589->8592 8590->8614 8595 3d9b24 CallCatchBlock 51 API calls 8591->8595 8592->8574 8593->8567 8594 3d9b24 CallCatchBlock 51 API calls 8593->8594 8596 3da751 8594->8596 8597 3da9dd 8595->8597 8596->8572 8600 3d9b24 CallCatchBlock 51 API calls 8596->8600 8598 3d9b24 CallCatchBlock 51 API calls 8597->8598 8601 3da9e5 8598->8601 8603 3da75b 8600->8603 8662 3da256 RtlUnwind 8601->8662 8602 3da81c ___TypeMatch 8602->8581 8626 3da5f0 8602->8626 8604 3d9b24 CallCatchBlock 51 API calls 8603->8604 8607 3da766 8604->8607 8616 3db0e9 8607->8616 8608 3da9f9 8611 3dafe9 __InternalCxxFrameHandler 51 API calls 8608->8611 8609 3da9b8 __InternalCxxFrameHandler 8659 3db2d6 8609->8659 8612 3daa05 __InternalCxxFrameHandler 8611->8612 8663 3daf60 8612->8663 8614->8609 8653 3dcc9b 8614->8653 8617 3db17d 8616->8617 8620 3db0fd ___TypeMatch 8616->8620 8618 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 8617->8618 8619 3db182 8618->8619 8620->8572 8622 3da081 8621->8622 8623 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 8622->8623 8624 3da0b7 8622->8624 8625 3da0d2 8623->8625 8624->8602 8627 3da60f 8626->8627 8628 3da602 8626->8628 8679 3da256 RtlUnwind 8627->8679 8675 3da557 8628->8675 8631 3da624 8632 3db001 __FrameHandler3::FrameUnwindToState 51 API calls 8631->8632 8633 3da635 __FrameHandler3::FrameUnwindToState 8632->8633 8680 3dad9c 8633->8680 8635 3da65d __InternalCxxFrameHandler 8635->8602 8637 3daa30 8636->8637 8647 3dab45 8636->8647 8638 3d9b24 CallCatchBlock 51 API calls 8637->8638 8639 3daa37 8638->8639 8640 3daa3e EncodePointer 8639->8640 8650 3daa79 8639->8650 8643 3d9b24 CallCatchBlock 51 API calls 8640->8643 8641 3dab4a 8644 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 8641->8644 8642 3daa96 8645 3da063 __InternalCxxFrameHandler 41 API calls 8642->8645 8648 3daa4c 8643->8648 8646 3dab4f 8644->8646 8651 3daaad 8645->8651 8647->8592 8649 3da130 CallCatchBlock 51 API calls 8648->8649 8648->8650 8649->8650 8650->8641 8650->8642 8650->8647 8651->8647 8652 3da5f0 __InternalCxxFrameHandler 53 API calls 8651->8652 8652->8651 8654 3dcca7 CallCatchBlock 8653->8654 8655 3dd240 _unexpected 41 API calls 8654->8655 8658 3dccac 8655->8658 8656 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 8657 3dccd6 8656->8657 8658->8656 8660 3db31d RaiseException 8659->8660 8661 3db2f0 8659->8661 8660->8591 8661->8660 8662->8608 8664 3daf6c __EH_prolog3_catch 8663->8664 8665 3d9b24 CallCatchBlock 51 API calls 8664->8665 8666 3daf71 8665->8666 8667 3daf94 8666->8667 8699 3db20c 8666->8699 8668 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 8667->8668 8670 3daf99 8668->8670 8676 3da563 CallCatchBlock 8675->8676 8677 3da419 __InternalCxxFrameHandler 41 API calls 8676->8677 8678 3da58b __InternalCxxFrameHandler ___AdjustPointer 8677->8678 8678->8627 8679->8631 8681 3dada8 CallCatchBlock 8680->8681 8694 3da2da 8681->8694 8684 3d9b24 CallCatchBlock 51 API calls 8685 3dadd4 8684->8685 8686 3d9b24 CallCatchBlock 51 API calls 8685->8686 8687 3daddf 8686->8687 8688 3d9b24 CallCatchBlock 51 API calls 8687->8688 8689 3dadea 8688->8689 8690 3d9b24 CallCatchBlock 51 API calls 8689->8690 8691 3dadf2 CallCatchBlock 8690->8691 8692 3daee4 CallCatchBlock 54 API calls 8691->8692 8693 3daecc 8692->8693 8693->8635 8695 3d9b24 CallCatchBlock 51 API calls 8694->8695 8696 3da2eb 8695->8696 8697 3d9b24 CallCatchBlock 51 API calls 8696->8697 8698 3da2f6 8697->8698 8698->8684 8700 3d9b24 CallCatchBlock 51 API calls 8699->8700 8701 3db212 8700->8701 8702 3dcc9b _unexpected 41 API calls 8701->8702 8703 3db228 8702->8703 9247 3d65b2 HeapAlloc 8704 3d662d 8707 3d6596 8704->8707 8706 3d6638 _AnonymousOriginator 8708 3d65b1 8707->8708 8709 3d65a2 8707->8709 8708->8706 8709->8708 8710 3d65a8 HeapDestroy 8709->8710 8710->8708 8711 3e212f 8713 3e2138 8711->8713 8712 3e21a0 8717 3e31ce 8712->8717 8720 3e32d7 8712->8720 8713->8712 8715 3e215f 8713->8715 8715->8717 8718 3e32d7 20 API calls 8715->8718 8719 3e31fe 8718->8719 8721 3e32e0 8720->8721 8724 3e374f 8721->8724 8725 3e378e __startOneArgErrorHandling 8724->8725 8728 3e3810 __startOneArgErrorHandling 8725->8728 8732 3e3be8 8725->8732 8729 3e3845 8728->8729 8735 3e3f01 8728->8735 8730 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 8729->8730 8731 3e21ee 8730->8731 8742 3e3c0b 8732->8742 8736 3e3f0e 8735->8736 8737 3e3f23 8735->8737 8739 3dbaf8 ___std_exception_copy 14 API calls 8736->8739 8740 3e3f28 8736->8740 8738 3dbaf8 ___std_exception_copy 14 API calls 8737->8738 8738->8740 8741 3e3f1b 8739->8741 8740->8729 8741->8729 8743 3e3c36 __raise_exc 8742->8743 8744 3e3e2f RaiseException 8743->8744 8745 3e3c06 8744->8745 8745->8728 9248 3e44aa 9249 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 9248->9249 9250 3e44bb 9249->9250 9251 3da2a9 9252 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 9251->9252 9253 3da2bb 9252->9253 9254 3dabde __InternalCxxFrameHandler 54 API calls 9253->9254 9255 3da2d4 9254->9255 8746 3dae28 8749 3daf9f 8746->8749 8748 3dae30 8750 3dafe5 8749->8750 8751 3dafaf 8749->8751 8750->8748 8751->8750 8752 3d9b24 CallCatchBlock 51 API calls 8751->8752 8753 3dafdb 8752->8753 8753->8748 9256 3df5a8 9257 3df4da 9256->9257 9260 3df4f4 9257->9260 9262 3df508 9257->9262 9263 3df532 9257->9263 9258 3dbaf8 ___std_exception_copy 14 API calls 9259 3df4fe 9258->9259 9261 3dba3a ___std_exception_copy 41 API calls 9259->9261 9260->9258 9260->9262 9261->9262 9263->9262 9264 3dbaf8 ___std_exception_copy 14 API calls 9263->9264 9264->9259 9265 3ddbab 9266 3ddbb8 9265->9266 9267 3ddbc8 9265->9267 9266->9267 9269 3dd52b __freea 14 API calls 9266->9269 9268 3dd52b __freea 14 API calls 9267->9268 9270 3ddbd0 9268->9270 9269->9266 8754 3e0929 8755 3e06de 8754->8755 8756 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 8755->8756 8757 3e06eb 8756->8757 9271 3e09a9 9274 3e06de 9271->9274 9272 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 9273 3e06eb 9272->9273 9274->9272 9274->9274 8761 3d7a26 8764 3dbb93 8761->8764 8765 3dd391 __FrameHandler3::FrameUnwindToState 14 API calls 8764->8765 8766 3d7a37 8765->8766 9275 3dd9a6 9276 3dba4a ___std_exception_copy 11 API calls 9275->9276 9277 3dd9b2 9276->9277 9278 3dda2c FindFirstFileExW 9277->9278 9279 3dda0d 9277->9279 9278->9279 9283 3dda63 9278->9283 9280 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 9279->9280 9282 3ddb27 9280->9282 9281 3ddac1 FindNextFileW 9281->9283 9284 3ddad6 9281->9284 9283->9281 9285 3ddb0d FindClose 9283->9285 9286 3ddaea FindClose 9284->9286 9287 3e0690 41 API calls 9284->9287 9285->9279 9286->9279 9288 3ddb08 9287->9288 9288->9286 9289 3deaa6 GetProcessHeap 8767 3d9d20 8768 3d9d32 8767->8768 8770 3d9d40 8767->8770 8769 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 8768->8769 8769->8770 8774 3dc01c 8775 3dc02c 8774->8775 8776 3dc033 8774->8776 8777 3dc054 GetModuleFileNameW 8776->8777 8778 3dc03e 8776->8778 8781 3dc079 8777->8781 8779 3dbaf8 ___std_exception_copy 14 API calls 8778->8779 8780 3dc043 8779->8780 8782 3dba3a ___std_exception_copy 41 API calls 8780->8782 8797 3dc2f3 8781->8797 8782->8775 8785 3dc0af 8787 3dbaf8 ___std_exception_copy 14 API calls 8785->8787 8786 3dc0bb 8788 3dc0b4 8786->8788 8789 3dc0f5 8786->8789 8787->8788 8790 3dd52b __freea 14 API calls 8788->8790 8791 3dc10c 8789->8791 8792 3dc116 8789->8792 8790->8775 8793 3dd52b __freea 14 API calls 8791->8793 8795 3dd52b __freea 14 API calls 8792->8795 8794 3dc114 8793->8794 8796 3dd52b __freea 14 API calls 8794->8796 8795->8794 8796->8775 8798 3dc0a6 8797->8798 8799 3dc304 8797->8799 8798->8785 8798->8786 8799->8798 8800 3dd6d2 _unexpected 14 API calls 8799->8800 8801 3dc32d 8800->8801 8802 3dd52b __freea 14 API calls 8801->8802 8802->8798 9290 3df39e 9291 3df3ab 9290->9291 9292 3dd6d2 _unexpected 14 API calls 9291->9292 9293 3df3c5 9292->9293 9294 3dd52b __freea 14 API calls 9293->9294 9295 3df3d1 9294->9295 9296 3dd6d2 _unexpected 14 API calls 9295->9296 9300 3df3f7 9295->9300 9297 3df3eb 9296->9297 9299 3dd52b __freea 14 API calls 9297->9299 9298 3de983 6 API calls 9298->9300 9299->9300 9300->9298 9301 3df403 9300->9301 8803 3e2a1a IsProcessorFeaturePresent 8804 3d6618 HeapSize 9302 3d6491 9303 3d64a0 RaiseException 9302->9303 9304 3db08d 9305 3db02f __CallSettingFrame@12 __FrameHandler3::FrameUnwindToState 9304->9305 9306 3db0a8 9305->9306 9307 3db0cf __FrameHandler3::FrameUnwindToState 51 API calls 9305->9307 9308 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 9306->9308 9310 3db0ad __FrameHandler3::FrameUnwindToState 9306->9310 9307->9306 9309 3db0e8 9308->9309 8805 3d9b08 8806 3d9b1f 8805->8806 8807 3d9b12 8805->8807 8807->8806 8808 3dbb0b ___std_exception_destroy 14 API calls 8807->8808 8808->8806 7395 3d7905 7396 3d7911 CallCatchBlock 7395->7396 7421 3d7657 7396->7421 7398 3d7918 7399 3d7a6b 7398->7399 7409 3d7942 ___scrt_is_nonwritable_in_current_image __FrameHandler3::FrameUnwindToState ___scrt_release_startup_lock 7398->7409 7472 3d7bb0 IsProcessorFeaturePresent 7399->7472 7401 3d7a72 7452 3dc006 7401->7452 7406 3d7961 7407 3d79e2 7432 3d7ccb 7407->7432 7409->7406 7409->7407 7455 3dbfe0 7409->7455 7410 3d79e8 7436 3d6c1e GetModuleHandleW GetProcAddress 7410->7436 7413 3d79fd 7461 3d7d04 GetModuleHandleW 7413->7461 7416 3d7a08 7417 3d7a11 7416->7417 7463 3dbfba 7416->7463 7466 3d77c8 7417->7466 7422 3d7660 7421->7422 7479 3d7db1 IsProcessorFeaturePresent 7422->7479 7426 3d7671 7427 3d7675 7426->7427 7489 3dc9b8 7426->7489 7427->7398 7430 3d768c 7430->7398 7806 3d95e0 7432->7806 7435 3d7cf1 7435->7410 7437 3d6c3d 7436->7437 7808 3d6887 7437->7808 7439 3d6c4c 7835 3d6dd7 7439->7835 7441 3d6c56 7838 3d6a8c 7441->7838 7444 3d6c6b LoadLibraryExW 7446 3d6c7e 7444->7446 7447 3d6c87 GetProcAddress 7444->7447 7445 3d6c83 7445->7413 7869 3d6820 GetLastError 7446->7869 7449 3d6ca5 FreeLibrary 7447->7449 7450 3d6c99 GetCommandLineW 7447->7450 7449->7445 7450->7449 8084 3dbe30 7452->8084 7456 3dbff6 _unexpected CallCatchBlock 7455->7456 7456->7407 8159 3dd240 GetLastError 7456->8159 7458 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 7459 3dccd6 7458->7459 7462 3d7a04 7461->7462 7462->7401 7462->7416 7464 3dbe30 __FrameHandler3::FrameUnwindToState 23 API calls 7463->7464 7465 3dbfc5 7464->7465 7465->7417 7467 3d77d4 7466->7467 7468 3d77ea 7467->7468 8186 3dc9ca 7467->8186 7468->7406 7470 3d77e2 7471 3d9759 ___scrt_uninitialize_crt 7 API calls 7470->7471 7471->7468 7473 3d7bc6 __FrameHandler3::FrameUnwindToState 7472->7473 7474 3d7c71 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7473->7474 7475 3d7cbc __FrameHandler3::FrameUnwindToState 7474->7475 7475->7401 7476 3dbfc9 7477 3dbe30 __FrameHandler3::FrameUnwindToState 23 API calls 7476->7477 7478 3d7a80 7477->7478 7480 3d766c 7479->7480 7481 3d973a 7480->7481 7498 3d9c12 7481->7498 7484 3d9743 7484->7426 7486 3d974b 7487 3d9756 7486->7487 7512 3d9c4e 7486->7512 7487->7426 7554 3decb3 7489->7554 7492 3d9759 7493 3d976c 7492->7493 7494 3d9762 7492->7494 7493->7427 7495 3d9bf7 ___vcrt_uninitialize_ptd 6 API calls 7494->7495 7496 3d9767 7495->7496 7497 3d9c4e ___vcrt_uninitialize_locks DeleteCriticalSection 7496->7497 7497->7493 7499 3d9c1b 7498->7499 7501 3d9c44 7499->7501 7503 3d973f 7499->7503 7516 3d9fe9 7499->7516 7502 3d9c4e ___vcrt_uninitialize_locks DeleteCriticalSection 7501->7502 7502->7503 7503->7484 7504 3d9bc4 7503->7504 7535 3d9efa 7504->7535 7507 3d9bd9 7507->7486 7510 3d9bf4 7510->7486 7513 3d9c78 7512->7513 7514 3d9c59 7512->7514 7513->7484 7515 3d9c63 DeleteCriticalSection 7514->7515 7515->7513 7515->7515 7521 3d9eb1 7516->7521 7519 3da021 InitializeCriticalSectionAndSpinCount 7520 3da00c 7519->7520 7520->7499 7522 3d9ec9 7521->7522 7523 3d9eec 7521->7523 7522->7523 7527 3d9e17 7522->7527 7523->7519 7523->7520 7526 3d9ede GetProcAddress 7526->7523 7533 3d9e23 7527->7533 7528 3d9e39 LoadLibraryExW 7530 3d9e9e 7528->7530 7531 3d9e57 GetLastError 7528->7531 7529 3d9e97 7529->7523 7529->7526 7530->7529 7532 3d9ea6 FreeLibrary 7530->7532 7531->7533 7532->7529 7533->7528 7533->7529 7534 3d9e79 LoadLibraryExW 7533->7534 7534->7530 7534->7533 7536 3d9eb1 ___vcrt_FlsSetValue 5 API calls 7535->7536 7537 3d9f14 7536->7537 7538 3d9f2d TlsAlloc 7537->7538 7539 3d9bce 7537->7539 7539->7507 7540 3d9fab 7539->7540 7541 3d9eb1 ___vcrt_FlsSetValue 5 API calls 7540->7541 7542 3d9fc5 7541->7542 7543 3d9fe0 TlsSetValue 7542->7543 7544 3d9be7 7542->7544 7543->7544 7544->7510 7545 3d9bf7 7544->7545 7546 3d9c07 7545->7546 7547 3d9c01 7545->7547 7546->7507 7549 3d9f35 7547->7549 7550 3d9eb1 ___vcrt_FlsSetValue 5 API calls 7549->7550 7551 3d9f4f 7550->7551 7552 3d9f67 TlsFree 7551->7552 7553 3d9f5b 7551->7553 7552->7553 7553->7546 7555 3d767e 7554->7555 7556 3decc3 7554->7556 7555->7430 7555->7492 7556->7555 7558 3dec27 7556->7558 7559 3dec33 CallCatchBlock 7558->7559 7570 3dd642 EnterCriticalSection 7559->7570 7561 3dec3a 7571 3df663 7561->7571 7564 3dec58 7595 3dec7e 7564->7595 7570->7561 7572 3df66f CallCatchBlock 7571->7572 7573 3df699 7572->7573 7574 3df678 7572->7574 7598 3dd642 EnterCriticalSection 7573->7598 7606 3dbaf8 7574->7606 7579 3dec49 7579->7564 7584 3deac1 GetStartupInfoW 7579->7584 7580 3df6d1 7612 3df6f8 7580->7612 7581 3df6a5 7581->7580 7599 3df5b3 7581->7599 7585 3deade 7584->7585 7586 3deb72 7584->7586 7585->7586 7587 3df663 42 API calls 7585->7587 7590 3deb77 7586->7590 7588 3deb06 7587->7588 7588->7586 7589 3deb36 GetFileType 7588->7589 7589->7588 7592 3deb7e 7590->7592 7591 3debc1 GetStdHandle 7591->7592 7592->7591 7593 3dec23 7592->7593 7594 3debd4 GetFileType 7592->7594 7593->7564 7594->7592 7805 3dd68a LeaveCriticalSection 7595->7805 7597 3dec69 7597->7556 7598->7581 7615 3dd6d2 7599->7615 7601 3df5d2 7627 3dd52b 7601->7627 7605 3df5c5 7605->7601 7622 3de983 7605->7622 7660 3dd391 GetLastError 7606->7660 7608 3dbafd 7609 3dba3a 7608->7609 7724 3db986 7609->7724 7804 3dd68a LeaveCriticalSection 7612->7804 7614 3df6ff 7614->7579 7620 3dd6df _unexpected 7615->7620 7616 3dd71f 7619 3dbaf8 ___std_exception_copy 13 API calls 7616->7619 7617 3dd70a RtlAllocateHeap 7618 3dd71d 7617->7618 7617->7620 7618->7605 7619->7618 7620->7616 7620->7617 7633 3ded5b 7620->7633 7646 3de7c1 7622->7646 7624 3de99f 7625 3de9bd InitializeCriticalSectionAndSpinCount 7624->7625 7626 3de9a8 7624->7626 7625->7626 7626->7605 7628 3dd536 HeapFree 7627->7628 7629 3dd560 7627->7629 7628->7629 7630 3dd54b GetLastError 7628->7630 7629->7581 7631 3dd558 __freea 7630->7631 7632 3dbaf8 ___std_exception_copy 12 API calls 7631->7632 7632->7629 7636 3ded88 7633->7636 7637 3ded94 CallCatchBlock 7636->7637 7642 3dd642 EnterCriticalSection 7637->7642 7639 3ded9f 7643 3deddb 7639->7643 7642->7639 7644 3dd68a __FrameHandler3::FrameUnwindToState LeaveCriticalSection 7643->7644 7645 3ded66 7644->7645 7645->7620 7647 3de7ef 7646->7647 7651 3de7eb _unexpected 7646->7651 7647->7651 7652 3de6f6 7647->7652 7650 3de809 GetProcAddress 7650->7651 7651->7624 7658 3de707 7652->7658 7653 3de79d 7653->7650 7653->7651 7654 3de725 LoadLibraryExW 7655 3de7a4 7654->7655 7656 3de740 GetLastError 7654->7656 7655->7653 7657 3de7b6 FreeLibrary 7655->7657 7656->7658 7657->7653 7658->7653 7658->7654 7659 3de773 LoadLibraryExW 7658->7659 7659->7655 7659->7658 7661 3dd3a7 7660->7661 7662 3dd3ad 7660->7662 7683 3de902 7661->7683 7666 3dd3b1 SetLastError 7662->7666 7688 3de941 7662->7688 7666->7608 7668 3dd6d2 _unexpected 12 API calls 7669 3dd3de 7668->7669 7670 3dd3f7 7669->7670 7671 3dd3e6 7669->7671 7673 3de941 _unexpected 6 API calls 7670->7673 7672 3de941 _unexpected 6 API calls 7671->7672 7674 3dd3f4 7672->7674 7675 3dd403 7673->7675 7680 3dd52b __freea 12 API calls 7674->7680 7676 3dd41e 7675->7676 7677 3dd407 7675->7677 7693 3dd06e 7676->7693 7679 3de941 _unexpected 6 API calls 7677->7679 7679->7674 7680->7666 7682 3dd52b __freea 12 API calls 7682->7666 7684 3de7c1 _unexpected 5 API calls 7683->7684 7685 3de91e 7684->7685 7686 3de939 TlsGetValue 7685->7686 7687 3de927 7685->7687 7687->7662 7689 3de7c1 _unexpected 5 API calls 7688->7689 7690 3de95d 7689->7690 7691 3de97b TlsSetValue 7690->7691 7692 3dd3c9 7690->7692 7692->7666 7692->7668 7698 3dcf02 7693->7698 7699 3dcf0e CallCatchBlock 7698->7699 7712 3dd642 EnterCriticalSection 7699->7712 7701 3dcf18 7713 3dcf48 7701->7713 7704 3dd014 7705 3dd020 CallCatchBlock 7704->7705 7716 3dd642 EnterCriticalSection 7705->7716 7707 3dd02a 7717 3dd1f5 7707->7717 7709 3dd042 7721 3dd062 7709->7721 7712->7701 7714 3dd68a __FrameHandler3::FrameUnwindToState LeaveCriticalSection 7713->7714 7715 3dcf36 7714->7715 7715->7704 7716->7707 7718 3dd22b _unexpected 7717->7718 7719 3dd204 _unexpected 7717->7719 7718->7709 7719->7718 7720 3dfd0a _unexpected 14 API calls 7719->7720 7720->7718 7722 3dd68a __FrameHandler3::FrameUnwindToState LeaveCriticalSection 7721->7722 7723 3dd050 7722->7723 7723->7682 7725 3db998 ___std_exception_copy 7724->7725 7730 3db9bd 7725->7730 7727 3db9b0 7741 3db776 7727->7741 7731 3db9cd 7730->7731 7734 3db9d4 7730->7734 7747 3db7db GetLastError 7731->7747 7736 3db9e2 7734->7736 7751 3db7b2 7734->7751 7735 3dba09 7735->7736 7754 3dba4a IsProcessorFeaturePresent 7735->7754 7736->7727 7738 3dba39 7739 3db986 ___std_exception_copy 41 API calls 7738->7739 7740 3dba46 7739->7740 7740->7727 7742 3db782 7741->7742 7743 3db799 7742->7743 7786 3db821 7742->7786 7745 3db7ac 7743->7745 7746 3db821 ___std_exception_copy 41 API calls 7743->7746 7745->7579 7746->7745 7748 3db7f4 7747->7748 7758 3dd442 7748->7758 7752 3db7bd GetLastError SetLastError 7751->7752 7753 3db7d6 7751->7753 7752->7735 7753->7735 7755 3dba56 7754->7755 7780 3db83e 7755->7780 7759 3dd45b 7758->7759 7760 3dd455 7758->7760 7762 3de941 _unexpected 6 API calls 7759->7762 7779 3db80c SetLastError 7759->7779 7761 3de902 _unexpected 6 API calls 7760->7761 7761->7759 7763 3dd475 7762->7763 7764 3dd6d2 _unexpected 14 API calls 7763->7764 7763->7779 7765 3dd485 7764->7765 7766 3dd48d 7765->7766 7767 3dd4a2 7765->7767 7768 3de941 _unexpected 6 API calls 7766->7768 7769 3de941 _unexpected 6 API calls 7767->7769 7777 3dd499 7768->7777 7770 3dd4ae 7769->7770 7771 3dd4c1 7770->7771 7772 3dd4b2 7770->7772 7773 3dd06e _unexpected 14 API calls 7771->7773 7775 3de941 _unexpected 6 API calls 7772->7775 7776 3dd4cc 7773->7776 7774 3dd52b __freea 14 API calls 7774->7779 7775->7777 7778 3dd52b __freea 14 API calls 7776->7778 7777->7774 7778->7779 7779->7734 7781 3db85a __FrameHandler3::FrameUnwindToState 7780->7781 7782 3db886 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7781->7782 7783 3db957 __FrameHandler3::FrameUnwindToState 7782->7783 7784 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 7783->7784 7785 3db975 GetCurrentProcess TerminateProcess 7784->7785 7785->7738 7787 3db82b 7786->7787 7788 3db834 7786->7788 7789 3db7db ___std_exception_copy 16 API calls 7787->7789 7788->7743 7790 3db830 7789->7790 7790->7788 7793 3dcd36 7790->7793 7794 3deeb2 __FrameHandler3::FrameUnwindToState EnterCriticalSection LeaveCriticalSection 7793->7794 7795 3dcd3b 7794->7795 7796 3dcd46 7795->7796 7797 3deef7 __FrameHandler3::FrameUnwindToState 40 API calls 7795->7797 7798 3dcd50 IsProcessorFeaturePresent 7796->7798 7799 3dcd6f 7796->7799 7797->7796 7800 3dcd5c 7798->7800 7801 3dbfc9 __FrameHandler3::FrameUnwindToState 23 API calls 7799->7801 7803 3db83e __FrameHandler3::FrameUnwindToState 8 API calls 7800->7803 7802 3dcd79 7801->7802 7803->7799 7804->7614 7805->7597 7807 3d7cde GetStartupInfoW 7806->7807 7807->7435 7809 3d6dd7 56 API calls 7808->7809 7810 3d6898 7809->7810 7811 3d68b1 GetModuleFileNameW 7810->7811 7812 3d68c9 7811->7812 7834 3d69a0 7812->7834 7871 3d664f 7812->7871 7814 3d69e3 7816 3d6914 7910 3d6eab 7816->7910 7817 3d6906 7901 3d6f7d 7817->7901 7820 3d6912 7886 3d6cc6 7820->7886 7822 3d6931 7890 3d6ffa 7822->7890 7824 3d693c 7894 3d6d76 7824->7894 7826 3d694e 7827 3d6dd7 56 API calls 7826->7827 7828 3d695e 7827->7828 7829 3d6973 SHGetFolderPathW 7828->7829 7830 3d698c 7829->7830 7830->7834 7923 3d6d3c 7830->7923 7832 3d6998 7833 3d6d3c CharLowerBuffW 7832->7833 7833->7834 7834->7439 7836 3d664f 56 API calls 7835->7836 7837 3d6ddf 7836->7837 7837->7441 7839 3d6ac1 __FrameHandler3::FrameUnwindToState 7838->7839 7840 3d6ad0 GetModuleFileNameW 7839->7840 7841 3d6aeb 7840->7841 7842 3d6af5 PathRemoveFileSpecW 7840->7842 7843 3d6820 GetLastError 7841->7843 8064 3db6ca 7842->8064 7861 3d6af0 7843->7861 7846 3d6b31 8073 3d683b 7846->8073 7849 3d6c1c 7849->7444 7849->7445 7851 3d6b40 7856 3d6eab 41 API calls 7851->7856 7852 3d6b63 7853 3db6ca 41 API calls 7852->7853 7854 3d6b7b 7853->7854 7855 3d6dd7 56 API calls 7854->7855 7857 3d6b89 7855->7857 7856->7861 8079 3d69ee RegOpenKeyExW 7857->8079 7859 3d6b9a 7860 3d6ba0 PathAppendW 7859->7860 7859->7861 7862 3d6bc5 7860->7862 7863 3d6bb3 PathAppendW 7860->7863 8057 3d73ee 7861->8057 7865 3d6820 GetLastError 7862->7865 7863->7862 7864 3d6bce 7863->7864 7866 3d683b 6 API calls 7864->7866 7865->7861 7867 3d6bd9 7866->7867 7867->7861 7868 3d6eab 41 API calls 7867->7868 7868->7861 7870 3d682a 7869->7870 7870->7445 7872 3d667d 7871->7872 7883 3d6666 7871->7883 7928 3d750b EnterCriticalSection 7872->7928 7874 3d750b 6 API calls 7876 3d66cd 7874->7876 7875 3d6688 7877 3d6692 GetProcessHeap 7875->7877 7875->7883 7880 3d781d 44 API calls 7876->7880 7885 3d6678 7876->7885 7933 3d781d 7877->7933 7882 3d671a 7880->7882 7884 3d74c1 __Init_thread_footer 5 API calls 7882->7884 7883->7874 7883->7885 7884->7885 7885->7814 7885->7816 7885->7817 8009 3d6dfe 7886->8009 7888 3d6cd4 PathRemoveFileSpecW 7889 3d6ce3 7888->7889 7889->7822 7891 3d7005 7890->7891 7893 3d7013 7891->7893 8011 3d70a4 7891->8011 7893->7824 7895 3d6d8e 7894->7895 7900 3d6da2 7894->7900 7896 3d6dc3 7895->7896 7897 3d6d9d 7895->7897 7898 3d6eab 41 API calls 7896->7898 7899 3d6ffa 14 API calls 7897->7899 7898->7900 7899->7900 7900->7826 8017 3d7387 EnterCriticalSection 7901->8017 7903 3d6f92 7904 3d6fa8 FindResourceExW 7903->7904 7906 3d7387 5 API calls 7903->7906 7907 3d6fe0 7903->7907 7909 3d6fef 7903->7909 8022 3d6539 LoadResource 7903->8022 7904->7903 7906->7903 7907->7909 8026 3d7118 FindResourceW 7907->8026 7909->7820 7912 3d6ec3 7910->7912 7920 3d6eb9 __InternalCxxFrameHandler 7910->7920 7911 3d6f57 7912->7911 7913 3d6f3d 7912->7913 7914 3d6ef3 7912->7914 7915 3d70a4 14 API calls 7913->7915 7916 3d6f04 7914->7916 7918 3d6f1a 7914->7918 7914->7920 7915->7920 7917 3dbaf8 ___std_exception_copy 14 API calls 7916->7917 7919 3d6f09 7917->7919 7918->7920 7921 3dbaf8 ___std_exception_copy 14 API calls 7918->7921 7922 3dba3a ___std_exception_copy 41 API calls 7919->7922 7920->7820 7921->7919 7922->7920 7924 3d6d4b 7923->7924 7925 3d6d6b 7924->7925 7926 3d6d56 CharLowerBuffW 7924->7926 7927 3d6d66 7926->7927 7927->7832 7929 3d751f 7928->7929 7930 3d7524 LeaveCriticalSection 7929->7930 7941 3d7593 7929->7941 7930->7875 7946 3d77f0 7933->7946 7936 3d74c1 EnterCriticalSection LeaveCriticalSection 7937 3d755d 7936->7937 7938 3d7579 SetEvent ResetEvent 7937->7938 7939 3d7568 RtlWakeAllConditionVariable 7937->7939 7938->7883 7939->7883 7942 3d75ba LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 7941->7942 7943 3d75a1 SleepConditionVariableCS 7941->7943 7944 3d75de 7942->7944 7943->7944 7944->7929 7947 3d77ff 7946->7947 7948 3d7806 7946->7948 7952 3dc80d 7947->7952 7955 3dc88a 7948->7955 7951 3d66b8 7951->7936 7953 3dc88a 44 API calls 7952->7953 7954 3dc81f 7953->7954 7954->7951 7958 3dc5d6 7955->7958 7959 3dc5e2 CallCatchBlock 7958->7959 7966 3dd642 EnterCriticalSection 7959->7966 7961 3dc5f0 7967 3dc631 7961->7967 7963 3dc5fd 7977 3dc625 7963->7977 7966->7961 7968 3dc64c 7967->7968 7969 3dc6bf _unexpected 7967->7969 7968->7969 7970 3dc69f 7968->7970 7980 3dbb26 7968->7980 7969->7963 7970->7969 7971 3dbb26 44 API calls 7970->7971 7973 3dc6b5 7971->7973 7976 3dd52b __freea 14 API calls 7973->7976 7974 3dc695 7975 3dd52b __freea 14 API calls 7974->7975 7975->7970 7976->7969 8008 3dd68a LeaveCriticalSection 7977->8008 7979 3dc60e 7979->7951 7981 3dbb4e 7980->7981 7982 3dbb33 7980->7982 7984 3dbb5d 7981->7984 7989 3dd565 7981->7989 7982->7981 7983 3dbb3f 7982->7983 7985 3dbaf8 ___std_exception_copy 14 API calls 7983->7985 7996 3dd598 7984->7996 7988 3dbb44 __FrameHandler3::FrameUnwindToState 7985->7988 7988->7974 7990 3dd585 HeapSize 7989->7990 7991 3dd570 7989->7991 7990->7984 7992 3dbaf8 ___std_exception_copy 14 API calls 7991->7992 7993 3dd575 7992->7993 7994 3dba3a ___std_exception_copy 41 API calls 7993->7994 7995 3dd580 7994->7995 7995->7984 7997 3dd5a5 7996->7997 7998 3dd5b0 7996->7998 7999 3dfac8 15 API calls 7997->7999 8000 3dd5b8 7998->8000 8007 3dd5c1 _unexpected 7998->8007 8005 3dd5ad 7999->8005 8003 3dd52b __freea 14 API calls 8000->8003 8001 3dd5eb HeapReAlloc 8001->8005 8001->8007 8002 3dd5c6 8004 3dbaf8 ___std_exception_copy 14 API calls 8002->8004 8003->8005 8004->8005 8005->7988 8006 3ded5b _unexpected EnterCriticalSection LeaveCriticalSection 8006->8007 8007->8001 8007->8002 8007->8006 8008->7979 8010 3d6e2f 8009->8010 8012 3d70b6 8011->8012 8014 3d70d9 __InternalCxxFrameHandler 8011->8014 8013 3dbaf8 ___std_exception_copy 14 API calls 8012->8013 8015 3d70bf __FrameHandler3::FrameUnwindToState 8012->8015 8013->8015 8014->7893 8015->8014 8016 3dbaf8 14 API calls ___std_exception_copy 8015->8016 8016->8015 8018 3d73a9 LeaveCriticalSection 8017->8018 8019 3d73a0 8017->8019 8018->7903 8019->8018 8032 3d7362 8019->8032 8023 3d656f 8022->8023 8024 3d654f LockResource 8022->8024 8023->7903 8024->8023 8025 3d655c SizeofResource 8024->8025 8025->8023 8027 3d7139 8026->8027 8028 3d7168 8026->8028 8029 3d6539 3 API calls 8027->8029 8028->7909 8030 3d7146 8029->8030 8030->8028 8043 3db61a 8030->8043 8033 3d736c 8032->8033 8034 3d7371 8033->8034 8042 3d64a0 RaiseException 8033->8042 8034->8018 8036 3d7386 EnterCriticalSection 8039 3d73a0 8036->8039 8040 3d73a9 LeaveCriticalSection 8036->8040 8039->8040 8041 3d7362 RaiseException 8039->8041 8040->8018 8041->8040 8042->8036 8044 3db62b 8043->8044 8052 3db627 __InternalCxxFrameHandler 8043->8052 8045 3db632 8044->8045 8049 3db645 _wmemset 8044->8049 8046 3dbaf8 ___std_exception_copy 14 API calls 8045->8046 8047 3db637 8046->8047 8048 3dba3a ___std_exception_copy 41 API calls 8047->8048 8048->8052 8050 3db67f 8049->8050 8051 3db676 8049->8051 8049->8052 8050->8052 8054 3dbaf8 ___std_exception_copy 14 API calls 8050->8054 8053 3dbaf8 ___std_exception_copy 14 API calls 8051->8053 8052->8028 8055 3db67b 8053->8055 8054->8055 8056 3dba3a ___std_exception_copy 41 API calls 8055->8056 8056->8052 8058 3d73f7 IsProcessorFeaturePresent 8057->8058 8059 3d73f6 8057->8059 8061 3d7acb 8058->8061 8059->7849 8083 3d7a8e SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 8061->8083 8063 3d7bae 8063->7849 8065 3db6d8 8064->8065 8067 3db6e6 8064->8067 8065->8067 8071 3db700 8065->8071 8066 3dbaf8 ___std_exception_copy 14 API calls 8068 3db6f0 8066->8068 8067->8066 8070 3dba3a ___std_exception_copy 41 API calls 8068->8070 8069 3d6b16 PathAppendW 8069->7841 8069->7846 8070->8069 8071->8069 8072 3dbaf8 ___std_exception_copy 14 API calls 8071->8072 8072->8068 8074 3d6852 8073->8074 8076 3d6878 8073->8076 8075 3d6859 GetFileAttributesExW 8074->8075 8074->8076 8075->8076 8077 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 8076->8077 8078 3d6885 8077->8078 8078->7851 8078->7852 8080 3d6a1f 8079->8080 8081 3d6a2b 8079->8081 8080->7859 8082 3d6a43 SHQueryValueExW 8081->8082 8082->8080 8083->8063 8085 3dbe5d 8084->8085 8086 3dbe6f 8084->8086 8087 3d7d04 __FrameHandler3::FrameUnwindToState GetModuleHandleW 8085->8087 8096 3dbcd9 8086->8096 8089 3dbe62 8087->8089 8089->8086 8111 3dbf1a GetModuleHandleExW 8089->8111 8091 3d7a78 8091->7476 8094 3dbec1 8097 3dbce5 CallCatchBlock 8096->8097 8117 3dd642 EnterCriticalSection 8097->8117 8099 3dbcef 8118 3dbd45 8099->8118 8101 3dbcfc 8122 3dbd1a 8101->8122 8104 3dbec7 8147 3dbef8 8104->8147 8107 3dbee5 8109 3dbf1a __FrameHandler3::FrameUnwindToState 3 API calls 8107->8109 8108 3dbed5 GetCurrentProcess TerminateProcess 8108->8107 8110 3dbeed ExitProcess 8109->8110 8112 3dbf59 GetProcAddress 8111->8112 8113 3dbf7a 8111->8113 8112->8113 8114 3dbf6d 8112->8114 8115 3dbe6e 8113->8115 8116 3dbf80 FreeLibrary 8113->8116 8114->8113 8115->8086 8116->8115 8117->8099 8120 3dbd51 CallCatchBlock 8118->8120 8119 3dbdb8 __FrameHandler3::FrameUnwindToState 8119->8101 8120->8119 8125 3dc823 8120->8125 8146 3dd68a LeaveCriticalSection 8122->8146 8124 3dbd08 8124->8091 8124->8104 8126 3dc82f __EH_prolog3 8125->8126 8129 3dc57b 8126->8129 8128 3dc856 __FrameHandler3::FrameUnwindToState 8128->8119 8130 3dc587 CallCatchBlock 8129->8130 8137 3dd642 EnterCriticalSection 8130->8137 8132 3dc595 8138 3dc733 8132->8138 8137->8132 8140 3dc5a2 8138->8140 8141 3dc752 8138->8141 8139 3dd52b __freea 14 API calls 8139->8140 8142 3dc5ca 8140->8142 8141->8139 8141->8140 8145 3dd68a LeaveCriticalSection 8142->8145 8144 3dc5b3 8144->8128 8145->8144 8146->8124 8152 3dd6a1 GetPEB 8147->8152 8150 3dbed1 8150->8107 8150->8108 8151 3dbf02 GetPEB 8151->8150 8153 3dd6bb 8152->8153 8154 3dbefd 8152->8154 8156 3de844 8153->8156 8154->8150 8154->8151 8157 3de7c1 _unexpected 5 API calls 8156->8157 8158 3de860 8157->8158 8158->8154 8160 3dd256 8159->8160 8163 3dd25c 8159->8163 8161 3de902 _unexpected 6 API calls 8160->8161 8161->8163 8162 3de941 _unexpected 6 API calls 8164 3dd278 8162->8164 8163->8162 8165 3dd260 SetLastError 8163->8165 8164->8165 8167 3dd6d2 _unexpected 14 API calls 8164->8167 8169 3dd2f5 8165->8169 8170 3dccac 8165->8170 8168 3dd28d 8167->8168 8171 3dd295 8168->8171 8172 3dd2a6 8168->8172 8173 3dcd36 __FrameHandler3::FrameUnwindToState 39 API calls 8169->8173 8170->7458 8174 3de941 _unexpected 6 API calls 8171->8174 8175 3de941 _unexpected 6 API calls 8172->8175 8176 3dd2fa 8173->8176 8177 3dd2a3 8174->8177 8178 3dd2b2 8175->8178 8183 3dd52b __freea 14 API calls 8177->8183 8179 3dd2cd 8178->8179 8180 3dd2b6 8178->8180 8181 3dd06e _unexpected 14 API calls 8179->8181 8182 3de941 _unexpected 6 API calls 8180->8182 8184 3dd2d8 8181->8184 8182->8177 8183->8165 8185 3dd52b __freea 14 API calls 8184->8185 8185->8165 8187 3dc9d5 8186->8187 8188 3dc9e7 ___scrt_uninitialize_crt 8186->8188 8189 3dc9e3 8187->8189 8191 3df395 8187->8191 8188->7470 8189->7470 8194 3df222 8191->8194 8197 3df176 8194->8197 8198 3df182 CallCatchBlock 8197->8198 8205 3dd642 EnterCriticalSection 8198->8205 8200 3df18c ___scrt_uninitialize_crt 8201 3df1f8 8200->8201 8206 3df0ea 8200->8206 8214 3df216 8201->8214 8205->8200 8207 3df0f6 CallCatchBlock 8206->8207 8217 3df4b2 EnterCriticalSection 8207->8217 8209 3df14c 8231 3df16a 8209->8231 8210 3df100 ___scrt_uninitialize_crt 8210->8209 8218 3df330 8210->8218 8333 3dd68a LeaveCriticalSection 8214->8333 8216 3df204 8216->8189 8217->8210 8219 3df345 ___std_exception_copy 8218->8219 8220 3df34c 8219->8220 8221 3df357 8219->8221 8222 3df222 ___scrt_uninitialize_crt 70 API calls 8220->8222 8234 3df2c7 8221->8234 8224 3df352 8222->8224 8226 3db776 ___std_exception_copy 41 API calls 8224->8226 8227 3df38f 8226->8227 8227->8209 8229 3df378 8247 3e0f24 8229->8247 8332 3df4c6 LeaveCriticalSection 8231->8332 8233 3df158 8233->8200 8235 3df2e0 8234->8235 8236 3df307 8234->8236 8235->8236 8237 3e065c ___scrt_uninitialize_crt 41 API calls 8235->8237 8236->8224 8240 3e065c 8236->8240 8238 3df2fc 8237->8238 8258 3e174f 8238->8258 8241 3e067d 8240->8241 8242 3e0668 8240->8242 8241->8229 8243 3dbaf8 ___std_exception_copy 14 API calls 8242->8243 8244 3e066d 8243->8244 8245 3dba3a ___std_exception_copy 41 API calls 8244->8245 8246 3e0678 8245->8246 8246->8229 8248 3e0f35 8247->8248 8251 3e0f42 8247->8251 8249 3dbaf8 ___std_exception_copy 14 API calls 8248->8249 8257 3e0f3a 8249->8257 8250 3e0f8b 8252 3dbaf8 ___std_exception_copy 14 API calls 8250->8252 8251->8250 8253 3e0f69 8251->8253 8254 3e0f90 8252->8254 8299 3e0e82 8253->8299 8256 3dba3a ___std_exception_copy 41 API calls 8254->8256 8256->8257 8257->8224 8260 3e175b CallCatchBlock 8258->8260 8259 3e181f 8261 3db9bd ___std_exception_copy 41 API calls 8259->8261 8260->8259 8262 3e17b0 8260->8262 8268 3e1763 8260->8268 8261->8268 8269 3df701 EnterCriticalSection 8262->8269 8264 3e17b6 8265 3e17d3 8264->8265 8270 3e1857 8264->8270 8296 3e1817 8265->8296 8268->8236 8269->8264 8271 3e187c 8270->8271 8289 3e189f ___scrt_uninitialize_crt 8270->8289 8272 3e1880 8271->8272 8274 3e18de 8271->8274 8273 3db9bd ___std_exception_copy 41 API calls 8272->8273 8273->8289 8275 3e18f5 8274->8275 8277 3e1f2e ___scrt_uninitialize_crt 43 API calls 8274->8277 8276 3e13db ___scrt_uninitialize_crt 42 API calls 8275->8276 8278 3e18ff 8276->8278 8277->8275 8279 3e1945 8278->8279 8280 3e1905 8278->8280 8283 3e19a8 WriteFile 8279->8283 8284 3e1959 8279->8284 8281 3e192f 8280->8281 8282 3e190c 8280->8282 8285 3e0fa1 ___scrt_uninitialize_crt 47 API calls 8281->8285 8282->8289 8290 3e1373 ___scrt_uninitialize_crt 6 API calls 8282->8290 8286 3e19ca GetLastError 8283->8286 8283->8289 8287 3e1996 8284->8287 8288 3e1961 8284->8288 8285->8289 8286->8289 8291 3e1459 ___scrt_uninitialize_crt 7 API calls 8287->8291 8292 3e1984 8288->8292 8293 3e1966 8288->8293 8289->8265 8290->8289 8291->8289 8294 3e161d ___scrt_uninitialize_crt 8 API calls 8292->8294 8293->8289 8295 3e1534 ___scrt_uninitialize_crt 7 API calls 8293->8295 8294->8289 8295->8289 8297 3df724 ___scrt_uninitialize_crt LeaveCriticalSection 8296->8297 8298 3e181d 8297->8298 8298->8268 8300 3e0e8e CallCatchBlock 8299->8300 8312 3df701 EnterCriticalSection 8300->8312 8302 3e0e9d 8303 3e0ee2 8302->8303 8313 3df7d8 8302->8313 8304 3dbaf8 ___std_exception_copy 14 API calls 8303->8304 8306 3e0ee9 8304->8306 8329 3e0f18 8306->8329 8307 3e0ec9 FlushFileBuffers 8307->8306 8308 3e0ed5 GetLastError 8307->8308 8326 3dbae5 8308->8326 8312->8302 8314 3df7fa 8313->8314 8315 3df7e5 8313->8315 8318 3dbae5 ___scrt_uninitialize_crt 14 API calls 8314->8318 8321 3df81f 8314->8321 8316 3dbae5 ___scrt_uninitialize_crt 14 API calls 8315->8316 8317 3df7ea 8316->8317 8320 3dbaf8 ___std_exception_copy 14 API calls 8317->8320 8319 3df82a 8318->8319 8322 3dbaf8 ___std_exception_copy 14 API calls 8319->8322 8323 3df7f2 8320->8323 8321->8307 8324 3df832 8322->8324 8323->8307 8325 3dba3a ___std_exception_copy 41 API calls 8324->8325 8325->8323 8327 3dd391 __FrameHandler3::FrameUnwindToState 14 API calls 8326->8327 8328 3dbaea 8327->8328 8328->8303 8330 3df724 ___scrt_uninitialize_crt LeaveCriticalSection 8329->8330 8331 3e0f01 8330->8331 8331->8257 8332->8233 8333->8216 8809 3e3507 8810 3e3520 __startOneArgErrorHandling 8809->8810 8811 3e3549 __startOneArgErrorHandling 8810->8811 8813 3e38a1 8810->8813 8814 3e38da __startOneArgErrorHandling 8813->8814 8815 3e3c0b __raise_exc RaiseException 8814->8815 8816 3e3901 __startOneArgErrorHandling 8814->8816 8815->8816 8817 3e3944 8816->8817 8818 3e391f 8816->8818 8819 3e3f01 __startOneArgErrorHandling 14 API calls 8817->8819 8824 3e3f30 8818->8824 8821 3e393f __startOneArgErrorHandling 8819->8821 8822 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 8821->8822 8823 3e3968 8822->8823 8823->8811 8825 3e3f3d 8824->8825 8826 3e3f4c __startOneArgErrorHandling 8825->8826 8830 3e3f7b __startOneArgErrorHandling 8825->8830 8827 3e3f01 __startOneArgErrorHandling 14 API calls 8826->8827 8828 3e3f65 8827->8828 8828->8821 8829 3e3fc9 8829->8821 8830->8829 8831 3e3f01 __startOneArgErrorHandling 14 API calls 8830->8831 8831->8829 8832 3dd107 8833 3dd122 8832->8833 8834 3dd112 8832->8834 8838 3dd128 8834->8838 8837 3dd52b __freea 14 API calls 8837->8833 8839 3dd13d 8838->8839 8840 3dd143 8838->8840 8841 3dd52b __freea 14 API calls 8839->8841 8842 3dd52b __freea 14 API calls 8840->8842 8841->8840 8843 3dd14f 8842->8843 8844 3dd52b __freea 14 API calls 8843->8844 8845 3dd15a 8844->8845 8846 3dd52b __freea 14 API calls 8845->8846 8847 3dd165 8846->8847 8848 3dd52b __freea 14 API calls 8847->8848 8849 3dd170 8848->8849 8850 3dd52b __freea 14 API calls 8849->8850 8851 3dd17b 8850->8851 8852 3dd52b __freea 14 API calls 8851->8852 8853 3dd186 8852->8853 8854 3dd52b __freea 14 API calls 8853->8854 8855 3dd191 8854->8855 8856 3dd52b __freea 14 API calls 8855->8856 8857 3dd19c 8856->8857 8858 3dd52b __freea 14 API calls 8857->8858 8859 3dd1aa 8858->8859 8864 3dcf54 8859->8864 8865 3dcf60 CallCatchBlock 8864->8865 8880 3dd642 EnterCriticalSection 8865->8880 8867 3dcf94 8881 3dcfb3 8867->8881 8869 3dcf6a 8869->8867 8871 3dd52b __freea 14 API calls 8869->8871 8871->8867 8872 3dcfbf 8873 3dcfcb CallCatchBlock 8872->8873 8885 3dd642 EnterCriticalSection 8873->8885 8875 3dcfd5 8876 3dd1f5 _unexpected 14 API calls 8875->8876 8877 3dcfe8 8876->8877 8886 3dd008 8877->8886 8880->8869 8884 3dd68a LeaveCriticalSection 8881->8884 8883 3dcfa1 8883->8872 8884->8883 8885->8875 8889 3dd68a LeaveCriticalSection 8886->8889 8888 3dcff6 8888->8837 8889->8888 9311 3dec87 9312 3dec8c 9311->9312 9314 3decaf 9312->9314 9315 3df62e 9312->9315 9316 3df63b 9315->9316 9317 3df65d 9315->9317 9318 3df649 DeleteCriticalSection 9316->9318 9319 3df657 9316->9319 9317->9312 9318->9318 9318->9319 9320 3dd52b __freea 14 API calls 9319->9320 9320->9317 8890 3e3205 8891 3e322d 8890->8891 8892 3e3265 8891->8892 8893 3e325e 8891->8893 8894 3e3257 8891->8894 8899 3e32c0 8893->8899 8895 3e32d7 20 API calls 8894->8895 8897 3e325c 8895->8897 8900 3e32e0 8899->8900 8901 3e374f __startOneArgErrorHandling 20 API calls 8900->8901 8902 3e3263 8901->8902 8903 3dd601 8904 3dd60c 8903->8904 8905 3de983 6 API calls 8904->8905 8906 3dd635 8904->8906 8908 3dd631 8904->8908 8905->8904 8909 3dd659 8906->8909 8910 3dd685 8909->8910 8911 3dd666 8909->8911 8910->8908 8912 3dd670 DeleteCriticalSection 8911->8912 8912->8910 8912->8912 9321 3d7a81 9324 3d8032 9321->9324 9323 3d7a86 9323->9323 9325 3d8048 9324->9325 9327 3d8051 9325->9327 9328 3d7fe5 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 9325->9328 9327->9323 9328->9327 9329 3db083 9332 3d9a5f 9329->9332 9333 3d9a71 9332->9333 9334 3d9a83 9332->9334 9333->9334 9335 3d9a79 9333->9335 9336 3d9b24 CallCatchBlock 51 API calls 9334->9336 9338 3d9a81 9335->9338 9339 3d9b24 CallCatchBlock 51 API calls 9335->9339 9337 3d9a88 9336->9337 9337->9338 9340 3d9b24 CallCatchBlock 51 API calls 9337->9340 9341 3d9aa1 9339->9341 9340->9338 9342 3d9b24 CallCatchBlock 51 API calls 9341->9342 9343 3d9aac 9342->9343 9344 3dcc9b _unexpected 41 API calls 9343->9344 9345 3d9ab4 9344->9345 9346 3d73fc 9357 3d7423 InitializeCriticalSectionAndSpinCount GetModuleHandleW 9346->9357 9348 3d7401 9349 3d7690 4 API calls 9348->9349 9350 3d7408 9349->9350 9351 3d740d 9350->9351 9352 3d741b 9350->9352 9353 3d781d 44 API calls 9351->9353 9354 3d7bb0 4 API calls 9352->9354 9355 3d7417 9353->9355 9356 3d7422 9354->9356 9358 3d7457 GetProcAddress GetProcAddress 9357->9358 9359 3d7446 GetModuleHandleW 9357->9359 9360 3d7475 9358->9360 9361 3d7487 CreateEventW 9358->9361 9359->9358 9362 3d749d 9359->9362 9360->9361 9363 3d7479 9360->9363 9361->9362 9361->9363 9364 3d7bb0 4 API calls 9362->9364 9363->9348 9365 3d74a4 DeleteCriticalSection 9364->9365 9366 3d74b9 CloseHandle 9365->9366 9367 3d74c0 9365->9367 9366->9367 9367->9348 8916 3dd975 8923 3ddbf8 8916->8923 8919 3dd98b 8921 3dd52b __freea 14 API calls 8919->8921 8920 3dd52b __freea 14 API calls 8920->8919 8922 3dd930 8921->8922 8924 3ddc0a 8923->8924 8925 3dd97f 8923->8925 8926 3ddc0f 8924->8926 8927 3ddc35 8924->8927 8925->8919 8925->8920 8928 3dd6d2 _unexpected 14 API calls 8926->8928 8927->8925 8929 3dbb26 44 API calls 8927->8929 8930 3ddc18 8928->8930 8931 3ddc55 8929->8931 8932 3dd52b __freea 14 API calls 8930->8932 8933 3dd52b __freea 14 API calls 8931->8933 8932->8925 8933->8925 9368 3e0df7 9371 3de20d 9368->9371 9372 3de216 9371->9372 9373 3de248 9371->9373 9377 3dd2fb 9372->9377 9378 3dd30c 9377->9378 9379 3dd306 9377->9379 9381 3de941 _unexpected 6 API calls 9378->9381 9399 3dd312 9378->9399 9380 3de902 _unexpected 6 API calls 9379->9380 9380->9378 9382 3dd326 9381->9382 9383 3dd6d2 _unexpected 14 API calls 9382->9383 9382->9399 9385 3dd336 9383->9385 9384 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 9386 3dd390 9384->9386 9387 3dd33e 9385->9387 9388 3dd353 9385->9388 9389 3de941 _unexpected 6 API calls 9387->9389 9390 3de941 _unexpected 6 API calls 9388->9390 9391 3dd34a 9389->9391 9392 3dd35f 9390->9392 9396 3dd52b __freea 14 API calls 9391->9396 9393 3dd363 9392->9393 9394 3dd372 9392->9394 9397 3de941 _unexpected 6 API calls 9393->9397 9395 3dd06e _unexpected 14 API calls 9394->9395 9398 3dd37d 9395->9398 9396->9399 9397->9391 9400 3dd52b __freea 14 API calls 9398->9400 9399->9384 9401 3dd317 9399->9401 9400->9401 9402 3de018 9401->9402 9425 3de16d 9402->9425 9407 3de05b 9407->9373 9408 3dfac8 15 API calls 9409 3de06c 9408->9409 9410 3de074 9409->9410 9411 3de082 9409->9411 9412 3dd52b __freea 14 API calls 9410->9412 9443 3de268 9411->9443 9412->9407 9415 3de0ba 9417 3dbaf8 ___std_exception_copy 14 API calls 9415->9417 9416 3de0d5 9420 3de101 9416->9420 9422 3dd52b __freea 14 API calls 9416->9422 9418 3de0bf 9417->9418 9421 3dd52b __freea 14 API calls 9418->9421 9419 3de14a 9424 3dd52b __freea 14 API calls 9419->9424 9420->9419 9454 3ddc8a 9420->9454 9421->9407 9422->9420 9424->9407 9426 3de179 CallCatchBlock 9425->9426 9428 3de193 9426->9428 9462 3dd642 EnterCriticalSection 9426->9462 9430 3de042 9428->9430 9432 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 9428->9432 9429 3de1cf 9463 3de1ec 9429->9463 9436 3ddd98 9430->9436 9434 3de20c 9432->9434 9433 3de1a3 9433->9429 9435 3dd52b __freea 14 API calls 9433->9435 9435->9429 9467 3ddb29 9436->9467 9439 3dddb9 GetOEMCP 9442 3ddde2 9439->9442 9440 3dddcb 9441 3dddd0 GetACP 9440->9441 9440->9442 9441->9442 9442->9407 9442->9408 9444 3ddd98 43 API calls 9443->9444 9445 3de288 9444->9445 9447 3de2c5 IsValidCodePage 9445->9447 9451 3de301 __FrameHandler3::FrameUnwindToState 9445->9451 9446 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 9448 3de0af 9446->9448 9449 3de2d7 9447->9449 9447->9451 9448->9415 9448->9416 9450 3de306 GetCPInfo 9449->9450 9453 3de2e0 __FrameHandler3::FrameUnwindToState 9449->9453 9450->9451 9450->9453 9451->9446 9620 3dde6c 9453->9620 9455 3ddc96 CallCatchBlock 9454->9455 9704 3dd642 EnterCriticalSection 9455->9704 9457 3ddca0 9705 3ddcd7 9457->9705 9462->9433 9466 3dd68a LeaveCriticalSection 9463->9466 9465 3de1f3 9465->9428 9466->9465 9468 3ddb47 9467->9468 9469 3ddb40 9467->9469 9468->9469 9470 3dd240 _unexpected 41 API calls 9468->9470 9469->9439 9469->9440 9471 3ddb68 9470->9471 9475 3e046d 9471->9475 9476 3ddb7e 9475->9476 9477 3e0480 9475->9477 9479 3e04cb 9476->9479 9477->9476 9483 3dff56 9477->9483 9480 3e04de 9479->9480 9481 3e04f3 9479->9481 9480->9481 9615 3de255 9480->9615 9481->9469 9484 3dff62 CallCatchBlock 9483->9484 9485 3dd240 _unexpected 41 API calls 9484->9485 9486 3dff6b 9485->9486 9487 3dffb1 9486->9487 9496 3dd642 EnterCriticalSection 9486->9496 9487->9476 9489 3dff89 9497 3dffd7 9489->9497 9494 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 9495 3dffd6 9494->9495 9496->9489 9498 3dff9a 9497->9498 9499 3dffe5 _unexpected 9497->9499 9501 3dffb6 9498->9501 9499->9498 9504 3dfd0a 9499->9504 9614 3dd68a LeaveCriticalSection 9501->9614 9503 3dffad 9503->9487 9503->9494 9506 3dfd8a 9504->9506 9511 3dfd20 9504->9511 9505 3dfdd8 9572 3dfe7b 9505->9572 9506->9505 9508 3dd52b __freea 14 API calls 9506->9508 9510 3dfdac 9508->9510 9509 3dfd53 9512 3dfd75 9509->9512 9520 3dd52b __freea 14 API calls 9509->9520 9513 3dd52b __freea 14 API calls 9510->9513 9511->9506 9511->9509 9515 3dd52b __freea 14 API calls 9511->9515 9514 3dd52b __freea 14 API calls 9512->9514 9516 3dfdbf 9513->9516 9517 3dfd7f 9514->9517 9519 3dfd48 9515->9519 9521 3dd52b __freea 14 API calls 9516->9521 9522 3dd52b __freea 14 API calls 9517->9522 9518 3dfe46 9523 3dd52b __freea 14 API calls 9518->9523 9532 3df858 9519->9532 9525 3dfd6a 9520->9525 9526 3dfdcd 9521->9526 9522->9506 9527 3dfe4c 9523->9527 9560 3df956 9525->9560 9530 3dd52b __freea 14 API calls 9526->9530 9527->9498 9528 3dfde6 9528->9518 9531 3dd52b 14 API calls __freea 9528->9531 9530->9505 9531->9528 9533 3df869 9532->9533 9559 3df952 9532->9559 9534 3df87a 9533->9534 9535 3dd52b __freea 14 API calls 9533->9535 9536 3df88c 9534->9536 9538 3dd52b __freea 14 API calls 9534->9538 9535->9534 9537 3df89e 9536->9537 9539 3dd52b __freea 14 API calls 9536->9539 9540 3df8b0 9537->9540 9541 3dd52b __freea 14 API calls 9537->9541 9538->9536 9539->9537 9542 3df8c2 9540->9542 9543 3dd52b __freea 14 API calls 9540->9543 9541->9540 9544 3df8d4 9542->9544 9546 3dd52b __freea 14 API calls 9542->9546 9543->9542 9545 3df8e6 9544->9545 9547 3dd52b __freea 14 API calls 9544->9547 9548 3df8f8 9545->9548 9549 3dd52b __freea 14 API calls 9545->9549 9546->9544 9547->9545 9550 3df90a 9548->9550 9551 3dd52b __freea 14 API calls 9548->9551 9549->9548 9552 3df91c 9550->9552 9554 3dd52b __freea 14 API calls 9550->9554 9551->9550 9553 3df92e 9552->9553 9555 3dd52b __freea 14 API calls 9552->9555 9556 3df940 9553->9556 9557 3dd52b __freea 14 API calls 9553->9557 9554->9552 9555->9553 9558 3dd52b __freea 14 API calls 9556->9558 9556->9559 9557->9556 9558->9559 9559->9509 9561 3df9bb 9560->9561 9562 3df963 9560->9562 9561->9512 9563 3df973 9562->9563 9564 3dd52b __freea 14 API calls 9562->9564 9565 3df985 9563->9565 9566 3dd52b __freea 14 API calls 9563->9566 9564->9563 9567 3df997 9565->9567 9568 3dd52b __freea 14 API calls 9565->9568 9566->9565 9569 3df9a9 9567->9569 9570 3dd52b __freea 14 API calls 9567->9570 9568->9567 9569->9561 9571 3dd52b __freea 14 API calls 9569->9571 9570->9569 9571->9561 9573 3dfe88 9572->9573 9577 3dfea7 9572->9577 9573->9577 9578 3df9e4 9573->9578 9576 3dd52b __freea 14 API calls 9576->9577 9577->9528 9579 3df9f5 9578->9579 9613 3dfac2 9578->9613 9580 3df9bf _unexpected 14 API calls 9579->9580 9581 3df9fd 9580->9581 9582 3df9bf _unexpected 14 API calls 9581->9582 9583 3dfa08 9582->9583 9584 3df9bf _unexpected 14 API calls 9583->9584 9585 3dfa13 9584->9585 9586 3df9bf _unexpected 14 API calls 9585->9586 9587 3dfa1e 9586->9587 9588 3df9bf _unexpected 14 API calls 9587->9588 9589 3dfa2c 9588->9589 9590 3dd52b __freea 14 API calls 9589->9590 9591 3dfa37 9590->9591 9592 3dd52b __freea 14 API calls 9591->9592 9593 3dfa42 9592->9593 9594 3dd52b __freea 14 API calls 9593->9594 9595 3dfa4d 9594->9595 9596 3df9bf _unexpected 14 API calls 9595->9596 9597 3dfa5b 9596->9597 9598 3df9bf _unexpected 14 API calls 9597->9598 9599 3dfa69 9598->9599 9600 3df9bf _unexpected 14 API calls 9599->9600 9601 3dfa7a 9600->9601 9602 3df9bf _unexpected 14 API calls 9601->9602 9603 3dfa88 9602->9603 9604 3df9bf _unexpected 14 API calls 9603->9604 9605 3dfa96 9604->9605 9606 3dd52b __freea 14 API calls 9605->9606 9607 3dfaa1 9606->9607 9608 3dd52b __freea 14 API calls 9607->9608 9609 3dfaac 9608->9609 9610 3dd52b __freea 14 API calls 9609->9610 9611 3dfab7 9610->9611 9612 3dd52b __freea 14 API calls 9611->9612 9612->9613 9613->9576 9614->9503 9616 3dd240 _unexpected 41 API calls 9615->9616 9617 3de25a 9616->9617 9618 3de16d ___scrt_uninitialize_crt 41 API calls 9617->9618 9619 3de265 9618->9619 9619->9481 9621 3dde94 GetCPInfo 9620->9621 9622 3ddf5d 9620->9622 9621->9622 9628 3ddeac 9621->9628 9624 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 9622->9624 9626 3de016 9624->9626 9626->9451 9631 3dfb64 9628->9631 9630 3e0dae 45 API calls 9630->9622 9632 3ddb29 41 API calls 9631->9632 9633 3dfb84 9632->9633 9651 3de50a 9633->9651 9635 3dfc48 9637 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 9635->9637 9636 3dfc40 9654 3dfc6d 9636->9654 9640 3ddf14 9637->9640 9638 3dfbb1 9638->9635 9638->9636 9639 3dfac8 15 API calls 9638->9639 9642 3dfbd6 __FrameHandler3::FrameUnwindToState __alloca_probe_16 9638->9642 9639->9642 9646 3e0dae 9640->9646 9642->9636 9643 3de50a ___scrt_uninitialize_crt MultiByteToWideChar 9642->9643 9644 3dfc21 9643->9644 9644->9636 9645 3dfc2c GetStringTypeW 9644->9645 9645->9636 9647 3ddb29 41 API calls 9646->9647 9648 3e0dc1 9647->9648 9658 3e0bc0 9648->9658 9652 3de51b MultiByteToWideChar 9651->9652 9652->9638 9655 3dfc79 9654->9655 9656 3dfc8a 9654->9656 9655->9656 9657 3dd52b __freea 14 API calls 9655->9657 9656->9635 9657->9656 9659 3e0bdb 9658->9659 9660 3de50a ___scrt_uninitialize_crt MultiByteToWideChar 9659->9660 9663 3e0c21 9660->9663 9661 3e0d99 9662 3d73ee __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 9661->9662 9664 3ddf35 9662->9664 9663->9661 9665 3dfac8 15 API calls 9663->9665 9667 3e0c47 __alloca_probe_16 9663->9667 9674 3e0ccd 9663->9674 9664->9630 9665->9667 9666 3dfc6d __freea 14 API calls 9666->9661 9668 3de50a ___scrt_uninitialize_crt MultiByteToWideChar 9667->9668 9667->9674 9669 3e0c8c 9668->9669 9669->9674 9686 3de9ce 9669->9686 9672 3e0cbe 9672->9674 9678 3de9ce 6 API calls 9672->9678 9673 3e0cf6 9675 3e0d81 9673->9675 9676 3dfac8 15 API calls 9673->9676 9679 3e0d08 __alloca_probe_16 9673->9679 9674->9666 9677 3dfc6d __freea 14 API calls 9675->9677 9676->9679 9677->9674 9678->9674 9679->9675 9680 3de9ce 6 API calls 9679->9680 9681 3e0d4b 9680->9681 9681->9675 9692 3de586 9681->9692 9683 3e0d65 9683->9675 9684 3e0d6e 9683->9684 9685 3dfc6d __freea 14 API calls 9684->9685 9685->9674 9695 3de6c2 9686->9695 9690 3dea1f LCMapStringW 9691 3de9df 9690->9691 9691->9672 9691->9673 9691->9674 9693 3de59d WideCharToMultiByte 9692->9693 9693->9683 9696 3de7c1 _unexpected 5 API calls 9695->9696 9697 3de6d8 9696->9697 9697->9691 9698 3dea2b 9697->9698 9701 3de6dc 9698->9701 9700 3dea36 9700->9690 9702 3de7c1 _unexpected 5 API calls 9701->9702 9703 3de6f2 9702->9703 9703->9700 9704->9457 9715 3de470 9705->9715 9707 3ddcf9 9708 3de470 41 API calls 9707->9708 9709 3ddd18 9708->9709 9710 3ddcad 9709->9710 9711 3dd52b __freea 14 API calls 9709->9711 9712 3ddccb 9710->9712 9711->9710 9729 3dd68a LeaveCriticalSection 9712->9729 9714 3ddcb9 9714->9419 9716 3de481 9715->9716 9720 3de47d __InternalCxxFrameHandler 9715->9720 9717 3de488 9716->9717 9721 3de49b __FrameHandler3::FrameUnwindToState 9716->9721 9718 3dbaf8 ___std_exception_copy 14 API calls 9717->9718 9719 3de48d 9718->9719 9722 3dba3a ___std_exception_copy 41 API calls 9719->9722 9720->9707 9721->9720 9723 3de4c9 9721->9723 9725 3de4d2 9721->9725 9722->9720 9724 3dbaf8 ___std_exception_copy 14 API calls 9723->9724 9726 3de4ce 9724->9726 9725->9720 9727 3dbaf8 ___std_exception_copy 14 API calls 9725->9727 9728 3dba3a ___std_exception_copy 41 API calls 9726->9728 9727->9726 9728->9720 9729->9714 9730 3de4f1 GetCommandLineA GetCommandLineW 8934 3dea70 8936 3dea7b 8934->8936 8937 3deaa1 8934->8937 8935 3dea8b FreeLibrary 8935->8936 8936->8935 8936->8937 8938 3dc973 8941 3dc98a 8938->8941 8942 3dc99e 8941->8942 8943 3dc986 8941->8943 8942->8943 8944 3dd52b __freea 14 API calls 8942->8944 8944->8943 9731 3d78f3 9736 3d7d47 SetUnhandledExceptionFilter 9731->9736 9733 3d78f8 9737 3dcc66 9733->9737 9735 3d7903 9736->9733 9738 3dcc8c 9737->9738 9739 3dcc72 9737->9739 9738->9735 9739->9738 9740 3dbaf8 ___std_exception_copy 14 API calls 9739->9740 9741 3dcc7c 9740->9741 9742 3dba3a ___std_exception_copy 41 API calls 9741->9742 9743 3dcc87 9742->9743 9743->9735 9744 3e21f1 9745 3e2215 9744->9745 9746 3e2266 9745->9746 9749 3e22f1 __startOneArgErrorHandling 9745->9749 9748 3e3313 15 API calls 9746->9748 9750 3e2278 9746->9750 9747 3e3549 __startOneArgErrorHandling 9748->9750 9749->9747 9751 3e38a1 20 API calls 9749->9751 9751->9747 8945 3dad6f 8946 3db2b7 ___std_exception_destroy 14 API calls 8945->8946 8947 3dad84 _AnonymousOriginator 8946->8947 8948 3d996e 8951 3d99bc 8948->8951 8952 3d9979 8951->8952 8953 3d99c5 8951->8953 8953->8952 8954 3d9b24 CallCatchBlock 51 API calls 8953->8954 8955 3d9a00 8954->8955 8956 3d9b24 CallCatchBlock 51 API calls 8955->8956 8957 3d9a0b 8956->8957 8958 3dcc9b _unexpected 41 API calls 8957->8958 8959 3d9a13 8958->8959 8960 3dc96a 8961 3d9759 ___scrt_uninitialize_crt 7 API calls 8960->8961 8962 3dc971 8961->8962 9752 3dd4e5 9760 3de884 9752->9760 9755 3dd391 __FrameHandler3::FrameUnwindToState 14 API calls 9757 3dd501 9755->9757 9756 3dd50e 9757->9756 9765 3dd511 9757->9765 9759 3dd4f9 9761 3de7c1 _unexpected 5 API calls 9760->9761 9762 3de8a0 9761->9762 9763 3de8b8 TlsAlloc 9762->9763 9764 3dd4ef 9762->9764 9763->9764 9764->9755 9764->9759 9766 3dd51b 9765->9766 9768 3dd521 9765->9768 9769 3de8c3 9766->9769 9768->9759 9770 3de7c1 _unexpected 5 API calls 9769->9770 9771 3de8df 9770->9771 9772 3de8e8 9771->9772 9773 3de8fa TlsFree 9771->9773 9772->9768 9777 3da5e7 9778 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 9777->9778 9779 3da5ef 9778->9779 8963 3df466 8964 3df395 ___scrt_uninitialize_crt 70 API calls 8963->8964 8965 3df46e 8964->8965 8973 3e1a57 8965->8973 8967 3df473 8983 3e1b02 8967->8983 8970 3df49d 8971 3dd52b __freea 14 API calls 8970->8971 8972 3df4a8 8971->8972 8974 3e1a63 CallCatchBlock 8973->8974 8987 3dd642 EnterCriticalSection 8974->8987 8976 3e1ada 8994 3e1af9 8976->8994 8979 3e1aae DeleteCriticalSection 8981 3dd52b __freea 14 API calls 8979->8981 8982 3e1a6e 8981->8982 8982->8976 8982->8979 8988 3e20a3 8982->8988 8984 3e1b19 8983->8984 8986 3df482 DeleteCriticalSection 8983->8986 8985 3dd52b __freea 14 API calls 8984->8985 8984->8986 8985->8986 8986->8967 8986->8970 8987->8982 8989 3e20b6 ___std_exception_copy 8988->8989 8997 3e1f7e 8989->8997 8991 3e20c2 8992 3db776 ___std_exception_copy 41 API calls 8991->8992 8993 3e20ce 8992->8993 8993->8982 9069 3dd68a LeaveCriticalSection 8994->9069 8996 3e1ae6 8996->8967 8998 3e1f8a CallCatchBlock 8997->8998 8999 3e1fb7 8998->8999 9000 3e1f94 8998->9000 9002 3e1faf 8999->9002 9008 3df4b2 EnterCriticalSection 8999->9008 9001 3db9bd ___std_exception_copy 41 API calls 9000->9001 9001->9002 9002->8991 9004 3e1fd5 9009 3e2015 9004->9009 9006 3e1fe2 9023 3e200d 9006->9023 9008->9004 9010 3e2022 9009->9010 9012 3e2045 9009->9012 9011 3db9bd ___std_exception_copy 41 API calls 9010->9011 9013 3e203d 9011->9013 9012->9013 9014 3df2c7 ___scrt_uninitialize_crt 66 API calls 9012->9014 9013->9006 9015 3e205d 9014->9015 9016 3e1b02 14 API calls 9015->9016 9017 3e2065 9016->9017 9018 3e065c ___scrt_uninitialize_crt 41 API calls 9017->9018 9019 3e2071 9018->9019 9026 3e289c 9019->9026 9022 3dd52b __freea 14 API calls 9022->9013 9068 3df4c6 LeaveCriticalSection 9023->9068 9025 3e2013 9025->9002 9027 3e28c5 9026->9027 9030 3e2078 9026->9030 9028 3e2914 9027->9028 9031 3e28ec 9027->9031 9029 3db9bd ___std_exception_copy 41 API calls 9028->9029 9029->9030 9030->9013 9030->9022 9033 3e280b 9031->9033 9034 3e2817 CallCatchBlock 9033->9034 9041 3df701 EnterCriticalSection 9034->9041 9036 3e2825 9038 3e2856 9036->9038 9042 3e293f 9036->9042 9055 3e2890 9038->9055 9041->9036 9043 3df7d8 ___scrt_uninitialize_crt 41 API calls 9042->9043 9044 3e294f 9043->9044 9045 3e2955 9044->9045 9047 3e2987 9044->9047 9049 3df7d8 ___scrt_uninitialize_crt 41 API calls 9044->9049 9058 3df747 9045->9058 9047->9045 9048 3df7d8 ___scrt_uninitialize_crt 41 API calls 9047->9048 9050 3e2993 CloseHandle 9048->9050 9051 3e297e 9049->9051 9050->9045 9052 3e299f GetLastError 9050->9052 9053 3df7d8 ___scrt_uninitialize_crt 41 API calls 9051->9053 9052->9045 9053->9047 9054 3e29ad ___scrt_uninitialize_crt 9054->9038 9067 3df724 LeaveCriticalSection 9055->9067 9057 3e2879 9057->9030 9059 3df7bd 9058->9059 9060 3df756 9058->9060 9061 3dbaf8 ___std_exception_copy 14 API calls 9059->9061 9060->9059 9066 3df780 9060->9066 9062 3df7c2 9061->9062 9063 3dbae5 ___scrt_uninitialize_crt 14 API calls 9062->9063 9064 3df7ad 9063->9064 9064->9054 9065 3df7a7 SetStdHandle 9065->9064 9066->9064 9066->9065 9067->9057 9068->9025 9069->8996 9780 3dace0 9783 3dad13 9780->9783 9786 3db254 9783->9786 9787 3db261 ___std_exception_copy 9786->9787 9791 3dacee 9786->9791 9788 3db28e 9787->9788 9787->9791 9792 3dcd85 9787->9792 9790 3dbb0b ___std_exception_destroy 14 API calls 9788->9790 9790->9791 9793 3dcda1 9792->9793 9794 3dcd93 9792->9794 9795 3dbaf8 ___std_exception_copy 14 API calls 9793->9795 9794->9793 9799 3dcdb9 9794->9799 9796 3dcda9 9795->9796 9797 3dba3a ___std_exception_copy 41 API calls 9796->9797 9798 3dcdb3 9797->9798 9798->9788 9799->9798 9800 3dbaf8 ___std_exception_copy 14 API calls 9799->9800 9800->9796 9801 3da3e3 9802 3dabde __InternalCxxFrameHandler 54 API calls 9801->9802 9803 3da409 9802->9803 9804 3e20e1 9805 3e2101 9804->9805 9808 3e2138 9805->9808 9807 3e212b 9810 3e213f 9808->9810 9809 3e21a0 9811 3e32d7 20 API calls 9809->9811 9812 3e31ce 9809->9812 9810->9809 9814 3e215f 9810->9814 9813 3e21ee 9811->9813 9812->9807 9813->9807 9814->9812 9815 3e32d7 20 API calls 9814->9815 9816 3e31fe 9815->9816 9816->9807 9817 3d65e2 9818 3d65f5 9817->9818 9819 3d65ec 9817->9819 9818->9819 9820 3d6605 HeapReAlloc 9818->9820 9820->9819 9821 3d72d6 9822 3d72de 9821->9822 9828 3d6511 InitializeCriticalSectionAndSpinCount 9822->9828 9825 3d7309 IsDebuggerPresent 9826 3d731e 9825->9826 9827 3d7313 OutputDebugStringW 9825->9827 9827->9826 9829 3d652c 9828->9829 9830 3d6520 GetLastError 9828->9830 9829->9825 9829->9826 9830->9829 9831 3dcbd6 9834 3dcb5d 9831->9834 9835 3dcb69 CallCatchBlock 9834->9835 9842 3dd642 EnterCriticalSection 9835->9842 9837 3dcb73 9838 3dcba1 9837->9838 9841 3dffd7 ___scrt_uninitialize_crt 14 API calls 9837->9841 9843 3dcbbf 9838->9843 9841->9837 9842->9837 9846 3dd68a LeaveCriticalSection 9843->9846 9845 3dcbad 9846->9845 9070 3d7d53 9071 3d7d8a 9070->9071 9073 3d7d65 9070->9073 9073->9071 9079 3d9ab5 9073->9079 9077 3dcc9b _unexpected 41 API calls 9078 3d7da8 9077->9078 9080 3d9b24 CallCatchBlock 51 API calls 9079->9080 9081 3d7d97 9080->9081 9082 3d9abe 9081->9082 9083 3d9b24 CallCatchBlock 51 API calls 9082->9083 9084 3d7da1 9083->9084 9084->9077 9085 3d704d 9086 3d705e 9085->9086 9088 3d706f 9086->9088 9089 3d71bf 9086->9089 9090 3d71de 9089->9090 9091 3d7233 9090->9091 9092 3d70a4 14 API calls 9090->9092 9093 3d720a 9092->9093 9093->9088 9094 3d734c DeleteCriticalSection 9095 3d73cc 9094->9095 9096 3d73db 9095->9096 9097 3dbb0b ___std_exception_destroy 14 API calls 9095->9097 9097->9096 9098 3dc34e 9111 3de674 GetEnvironmentStringsW 9098->9111 9100 3dc35f 9101 3dc365 9100->9101 9102 3dc371 9100->9102 9103 3dd52b __freea 14 API calls 9101->9103 9118 3dc3a2 9102->9118 9105 3dc36b 9103->9105 9107 3dd52b __freea 14 API calls 9108 3dc395 9107->9108 9109 3dd52b __freea 14 API calls 9108->9109 9110 3dc39b 9109->9110 9112 3de685 9111->9112 9113 3de683 9111->9113 9140 3dfac8 9112->9140 9113->9100 9115 3de69a __InternalCxxFrameHandler 9116 3dd52b __freea 14 API calls 9115->9116 9117 3de6b4 FreeEnvironmentStringsW 9116->9117 9117->9100 9120 3dc3c1 9118->9120 9119 3dd6d2 _unexpected 14 API calls 9121 3dc401 9119->9121 9120->9119 9122 3dc409 9121->9122 9130 3dc413 9121->9130 9123 3dd52b __freea 14 API calls 9122->9123 9139 3dc378 9123->9139 9124 3dc488 9125 3dd52b __freea 14 API calls 9124->9125 9125->9139 9126 3dd6d2 _unexpected 14 API calls 9126->9130 9127 3dc498 9129 3dc4c0 14 API calls 9127->9129 9128 3db6ca 41 API calls 9128->9130 9131 3dc49e 9129->9131 9130->9124 9130->9126 9130->9127 9130->9128 9132 3dc4b3 9130->9132 9134 3dd52b __freea 14 API calls 9130->9134 9133 3dd52b __freea 14 API calls 9131->9133 9135 3dba4a ___std_exception_copy 11 API calls 9132->9135 9136 3dc4a6 9133->9136 9134->9130 9138 3dc4bf 9135->9138 9137 3dd52b __freea 14 API calls 9136->9137 9137->9139 9139->9107 9141 3dfb06 9140->9141 9145 3dfad6 _unexpected 9140->9145 9142 3dbaf8 ___std_exception_copy 14 API calls 9141->9142 9144 3dfb04 9142->9144 9143 3dfaf1 HeapAlloc 9143->9144 9143->9145 9144->9115 9145->9141 9145->9143 9146 3ded5b _unexpected 2 API calls 9145->9146 9146->9145 9850 3dccc7 9851 3dccca 9850->9851 9852 3dcd36 __FrameHandler3::FrameUnwindToState 41 API calls 9851->9852 9853 3dccd6 9852->9853 9854 3d65c7 9855 3d65de 9854->9855 9856 3d65d0 HeapFree 9854->9856 9856->9855 9151 3d7840 9152 3d7848 9151->9152 9168 3dcb20 9152->9168 9154 3d7853 9175 3d7690 9154->9175 9156 3d7bb0 4 API calls 9158 3d78ea 9156->9158 9157 3d7868 __RTC_Initialize 9159 3d781d 44 API calls 9157->9159 9166 3d78c5 9157->9166 9160 3d7881 9159->9160 9160->9166 9181 3d8083 InitializeSListHead 9160->9181 9162 3d7897 9182 3d8092 9162->9182 9164 3d78ba 9188 3dcbfd 9164->9188 9166->9156 9167 3d78e2 9166->9167 9169 3dcb52 9168->9169 9170 3dcb2f 9168->9170 9169->9154 9170->9169 9171 3dbaf8 ___std_exception_copy 14 API calls 9170->9171 9172 3dcb42 9171->9172 9173 3dba3a ___std_exception_copy 41 API calls 9172->9173 9174 3dcb4d 9173->9174 9174->9154 9176 3d769c 9175->9176 9177 3d76a0 9175->9177 9176->9157 9178 3d7bb0 4 API calls 9177->9178 9180 3d76ad ___scrt_release_startup_lock 9177->9180 9179 3d7716 9178->9179 9180->9157 9181->9162 9195 3dccd7 9182->9195 9184 3d80a3 9185 3d80aa 9184->9185 9186 3d7bb0 4 API calls 9184->9186 9185->9164 9187 3d80b2 9186->9187 9189 3dd240 _unexpected 41 API calls 9188->9189 9190 3dcc08 9189->9190 9191 3dcc40 9190->9191 9192 3dbaf8 ___std_exception_copy 14 API calls 9190->9192 9191->9166 9193 3dcc35 9192->9193 9194 3dba3a ___std_exception_copy 41 API calls 9193->9194 9194->9191 9196 3dccf5 9195->9196 9200 3dcd15 9195->9200 9197 3dbaf8 ___std_exception_copy 14 API calls 9196->9197 9198 3dcd0b 9197->9198 9199 3dba3a ___std_exception_copy 41 API calls 9198->9199 9199->9200 9200->9184

                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                              Function 003D6C1E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 003D6C2C
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 003D6C33
                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 003D6C72
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,DllEntry), ref: 003D6C8D
                                                                                                                                                                                              • GetCommandLineW.KERNEL32(?), ref: 003D6C9C
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 003D6CAF
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AddressLibraryProc$CommandFreeHandleLineLoadModule
                                                                                                                                                                                              • String ID: DllEntry$SetDefaultDllDirectories$kernel32.dll
                                                                                                                                                                                              • API String ID: 1042781669-3472957018
                                                                                                                                                                                              • Opcode ID: fceba9aee9eab21a70acc67afb8b839ee76b154a46c5c33087e7953ef62a38d6
                                                                                                                                                                                              • Instruction ID: d8d08c60e897af7663feeb166d8aa1f71137e7616439c780ba8d9b8cf0944f9d
                                                                                                                                                                                              • Opcode Fuzzy Hash: fceba9aee9eab21a70acc67afb8b839ee76b154a46c5c33087e7953ef62a38d6
                                                                                                                                                                                              • Instruction Fuzzy Hash: 6711E573950216BBCB23ABA4BC4BE6E376CDB04791F110116F852AB390EA208D0097A0
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003DBEC7 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,?,003DBEC1,?,003DB83D,?,?,89ABB79D,003DB83D,?), ref: 003DBED8
                                                                                                                                                                                              • TerminateProcess.KERNEL32(00000000,?,003DBEC1,?,003DB83D,?,?,89ABB79D,003DB83D,?), ref: 003DBEDF
                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 003DBEF1
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                              • Opcode ID: fc1199e2c70ebcea94ad8eda4592b6349464ad4ae2feecff5d91ac11972d3104
                                                                                                                                                                                              • Instruction ID: 1b3ac0a08d3af37b8a6b970f682f18e7f8774d81b0314d1060de3c6eb9430506
                                                                                                                                                                                              • Opcode Fuzzy Hash: fc1199e2c70ebcea94ad8eda4592b6349464ad4ae2feecff5d91ac11972d3104
                                                                                                                                                                                              • Instruction Fuzzy Hash: DAD09233008188EBCF232F61FD4D9997F2EBF44395F064115BA195E2B1DB319E529A91
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D6887 Relevance: 3.1, APIs: 2, Instructions: 122COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000104), ref: 003D68B9
                                                                                                                                                                                              • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,00000000,00000104,?,?,00000000), ref: 003D697C
                                                                                                                                                                                                • Part of subcall function 003D6F7D: FindResourceExW.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,00000000,?,?,003D6912,-00000010), ref: 003D6FAE
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FileFindFolderModuleNamePathResource
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2248019921-0
                                                                                                                                                                                              • Opcode ID: d063dba65291fad91483953743e0f124686a41c2b9d8ad113b4a8ada6fc7c26a
                                                                                                                                                                                              • Instruction ID: 26e3d7f0692aac0d1c904fc7db9c67c7ba962be728bc88c71f836d885a96b932
                                                                                                                                                                                              • Opcode Fuzzy Hash: d063dba65291fad91483953743e0f124686a41c2b9d8ad113b4a8ada6fc7c26a
                                                                                                                                                                                              • Instruction Fuzzy Hash: 45416673D00119ABCB06EBB4F9A79FEB779AF50700F51456AA421AB381DB345F05CB50
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003DD6D2 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 87 3dd6d2-3dd6dd 88 3dd6df-3dd6e9 87->88 89 3dd6eb-3dd6f1 87->89 88->89 90 3dd71f-3dd72a call 3dbaf8 88->90 91 3dd70a-3dd71b RtlAllocateHeap 89->91 92 3dd6f3-3dd6f4 89->92 98 3dd72c-3dd72e 90->98 93 3dd71d 91->93 94 3dd6f6-3dd6fd call 3dcc5f 91->94 92->91 93->98 94->90 100 3dd6ff-3dd708 call 3ded5b 94->100 100->90 100->91
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000008,?,?,?,003DD3DE,00000001,00000364,?,00000006,000000FF,?,003DBB6F,00000000,003DC8BB,00000004), ref: 003DD713
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AllocateHeap
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1279760036-0
                                                                                                                                                                                              • Opcode ID: 54c8f5adacdfb7288bebe46cd279f0f69e081ef606b278d3ba4d7b8e1657daf0
                                                                                                                                                                                              • Instruction ID: da97f6ad3a4e7b8bf58f892e9d79056a77e185cbb2aee76a4fb80e39b642cc8f
                                                                                                                                                                                              • Opcode Fuzzy Hash: 54c8f5adacdfb7288bebe46cd279f0f69e081ef606b278d3ba4d7b8e1657daf0
                                                                                                                                                                                              • Instruction Fuzzy Hash: 29F0E233610124ABDB336E76BC45B6B7B5CAF417A0F169293F908AF3D5CA20DC0482E0
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                              Function 003DD9B3 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 003DDA4E
                                                                                                                                                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 003DDAC9
                                                                                                                                                                                              • FindClose.KERNEL32(00000000), ref: 003DDAEB
                                                                                                                                                                                              • FindClose.KERNEL32(00000000), ref: 003DDB0E
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Find$CloseFile$FirstNext
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1164774033-0
                                                                                                                                                                                              • Opcode ID: f92f0be568ba1d35787194b6d1e4e5cb234d96313f78de7f96d5a14839b1ce14
                                                                                                                                                                                              • Instruction ID: 36fabf6034c9347496ca81a85804dea2b036295d19ec885e353d77fd85858ade
                                                                                                                                                                                              • Opcode Fuzzy Hash: f92f0be568ba1d35787194b6d1e4e5cb234d96313f78de7f96d5a14839b1ce14
                                                                                                                                                                                              • Instruction Fuzzy Hash: DA41A872904629AEDB32DF68ECC8ABAB77DEB44304F158197E405DB284E7309E84CB54
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D7BB0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 003D7BBC
                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32 ref: 003D7C88
                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 003D7CA8
                                                                                                                                                                                              • UnhandledExceptionFilter.KERNEL32(?), ref: 003D7CB2
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 254469556-0
                                                                                                                                                                                              • Opcode ID: 3534141d84f5349cf3b8fed0ec14885b53655457a865c7a3e4450f5bbd564465
                                                                                                                                                                                              • Instruction ID: a6e76eb7ea5f1e6b693365d8482271e0a3c4fd9f953f50fd5b445ed612a2ded0
                                                                                                                                                                                              • Opcode Fuzzy Hash: 3534141d84f5349cf3b8fed0ec14885b53655457a865c7a3e4450f5bbd564465
                                                                                                                                                                                              • Instruction Fuzzy Hash: E1312B75D05218DFDB22DFA4E9897CDBBB8BF04300F1041AAE40DAB290EB715A85CF45
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D7423 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 263 3d7423-3d7444 InitializeCriticalSectionAndSpinCount GetModuleHandleW 264 3d7457-3d7473 GetProcAddress * 2 263->264 265 3d7446-3d7455 GetModuleHandleW 263->265 266 3d7475-3d7477 264->266 267 3d7487-3d749b CreateEventW 264->267 265->264 268 3d749d-3d74b7 call 3d7bb0 DeleteCriticalSection 265->268 266->267 269 3d7479-3d747f 266->269 267->268 270 3d7484-3d7486 267->270 273 3d74b9-3d74ba CloseHandle 268->273 274 3d74c0 268->274 269->270 273->274
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • InitializeCriticalSectionAndSpinCount.KERNEL32(003E592C,00000FA0,?,?,003D7401), ref: 003D742F
                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,003D7401), ref: 003D743A
                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,003D7401), ref: 003D744B
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 003D745D
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 003D746B
                                                                                                                                                                                              • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,003D7401), ref: 003D748E
                                                                                                                                                                                              • DeleteCriticalSection.KERNEL32(003E592C,00000007,?,?,003D7401), ref: 003D74AA
                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,003D7401), ref: 003D74BA
                                                                                                                                                                                              Strings
                                                                                                                                                                                              • kernel32.dll, xrefs: 003D7446
                                                                                                                                                                                              • api-ms-win-core-synch-l1-2-0.dll, xrefs: 003D7435
                                                                                                                                                                                              • SleepConditionVariableCS, xrefs: 003D7457
                                                                                                                                                                                              • WakeAllConditionVariable, xrefs: 003D7463
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                                              • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                                              • API String ID: 2565136772-3242537097
                                                                                                                                                                                              • Opcode ID: 0e1378d9383ea8bcbcd74b84f8b3ef66f27aa6b3b994d454d5f8d40f94190a52
                                                                                                                                                                                              • Instruction ID: 83e3556cd48d6de441c2edaad8d8858dde728611568b752476210b3810f8ccc0
                                                                                                                                                                                              • Opcode Fuzzy Hash: 0e1378d9383ea8bcbcd74b84f8b3ef66f27aa6b3b994d454d5f8d40f94190a52
                                                                                                                                                                                              • Instruction Fuzzy Hash: FF01D876B49790BBD7335BB67C8DE9A3B6C9B44761F010212F904DA3D1EB64CC048660
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003DA670 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 275 3da670-3da69b call 3db229 278 3daa14-3daa19 call 3dcd36 275->278 279 3da6a1-3da6a4 275->279 279->278 280 3da6aa-3da6b3 279->280 282 3da6b9-3da6bd 280->282 283 3da7b0-3da7b6 280->283 282->283 285 3da6c3-3da6ca 282->285 286 3da7be-3da7cc 283->286 287 3da6cc-3da6d3 285->287 288 3da6e2-3da6e7 285->288 289 3da97d-3da980 286->289 290 3da7d2-3da7d6 286->290 287->288 292 3da6d5-3da6dc 287->292 288->283 295 3da6ed-3da6f5 call 3d9b24 288->295 293 3da9a3-3da9ac call 3d9b24 289->293 294 3da982-3da985 289->294 290->289 291 3da7dc-3da7e3 290->291 296 3da7fb-3da801 291->296 297 3da7e5-3da7ec 291->297 292->283 292->288 293->278 308 3da9ae-3da9b2 293->308 294->278 299 3da98b-3da9a0 call 3daa1a 294->299 295->308 309 3da6fb-3da714 call 3d9b24 * 2 295->309 304 3da919-3da91d 296->304 305 3da807-3da82e call 3da063 296->305 297->296 302 3da7ee-3da7f5 297->302 299->293 302->289 302->296 311 3da91f-3da928 call 3d990e 304->311 312 3da929-3da935 304->312 305->304 320 3da834-3da837 305->320 309->278 333 3da71a-3da720 309->333 311->312 312->293 316 3da937-3da93b 312->316 317 3da94d-3da955 316->317 318 3da93d-3da945 316->318 323 3da96c-3da979 call 3db0e9 317->323 324 3da957-3da96a call 3d9b24 * 2 317->324 318->293 322 3da947-3da94b 318->322 326 3da83a-3da84f 320->326 322->293 322->317 340 3da9d8-3da9ed call 3d9b24 * 2 323->340 341 3da97b 323->341 348 3da9b3 call 3dcc9b 324->348 330 3da8fa-3da90d 326->330 331 3da855-3da858 326->331 330->326 334 3da913-3da916 330->334 331->330 336 3da85e-3da866 331->336 338 3da74c-3da754 call 3d9b24 333->338 339 3da722-3da726 333->339 334->304 336->330 342 3da86c-3da880 336->342 360 3da7b8-3da7bb 338->360 361 3da756-3da776 call 3d9b24 * 2 call 3db0e9 338->361 339->338 344 3da728-3da72f 339->344 370 3da9ef 340->370 371 3da9f2-3daa0f call 3da256 call 3dafe9 call 3db1a6 call 3daf60 340->371 341->293 345 3da883-3da893 342->345 349 3da731-3da738 344->349 350 3da743-3da746 344->350 351 3da8bb-3da8c8 345->351 352 3da895-3da8a8 call 3dab50 345->352 365 3da9b8-3da9d3 call 3d990e call 3dacfb call 3db2d6 348->365 349->350 358 3da73a-3da741 349->358 350->278 350->338 351->345 356 3da8ca 351->356 367 3da8cc-3da8f4 call 3da5f0 352->367 368 3da8aa-3da8b0 352->368 364 3da8f7 356->364 358->338 358->350 360->286 361->360 388 3da778-3da77d 361->388 364->330 365->340 367->364 368->352 373 3da8b2-3da8b8 368->373 370->371 371->278 373->351 388->348 390 3da783-3da796 call 3dad50 388->390 390->365 395 3da79c-3da7a8 390->395 395->348 396 3da7ae 395->396 396->390
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • IsInExceptionSpec.LIBVCRUNTIME ref: 003DA76D
                                                                                                                                                                                              • type_info::operator==.LIBVCRUNTIME ref: 003DA78F
                                                                                                                                                                                              • ___TypeMatch.LIBVCRUNTIME ref: 003DA89E
                                                                                                                                                                                              • IsInExceptionSpec.LIBVCRUNTIME ref: 003DA970
                                                                                                                                                                                              • _UnwindNestedFrames.LIBCMT ref: 003DA9F4
                                                                                                                                                                                              • CallUnexpected.LIBVCRUNTIME ref: 003DAA0F
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                                              • String ID: csm$csm$csm$I=
                                                                                                                                                                                              • API String ID: 2123188842-1669862022
                                                                                                                                                                                              • Opcode ID: a3bfdab13fa81a65ba1b736b8cb938b2dbd2b313e988f7a205eb0ec670d92908
                                                                                                                                                                                              • Instruction ID: afc7bb7acaf752aef84f71741b8ea7cdd93fb0c8ba96282ab6f57e6363bc207f
                                                                                                                                                                                              • Opcode Fuzzy Hash: a3bfdab13fa81a65ba1b736b8cb938b2dbd2b313e988f7a205eb0ec670d92908
                                                                                                                                                                                              • Instruction Fuzzy Hash: 3CB16B72800609EFCF26DFA4EA819AEBBB5FF04310B16415BE8156B312D735DA51CB92
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D6A8C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 003D6AE1
                                                                                                                                                                                              • PathRemoveFileSpecW.SHLWAPI(?,?,?,00000104), ref: 003D6AFC
                                                                                                                                                                                              • PathAppendW.SHLWAPI(?,goopdate.dll,?,?,00000104), ref: 003D6B2B
                                                                                                                                                                                                • Part of subcall function 003D6820: GetLastError.KERNEL32(003D6AF0,?,?,00000104), ref: 003D6820
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FilePath$AppendErrorLastModuleNameRemoveSpec
                                                                                                                                                                                              • String ID: goopdate.dll
                                                                                                                                                                                              • API String ID: 3739599460-235033069
                                                                                                                                                                                              • Opcode ID: 1efcefbcc86c02dd90a150c59d1440196e67a4b5fb819cdf1df01e62e384f165
                                                                                                                                                                                              • Instruction ID: 06ac72bdd1c62d5661dd02fab5f54f14a0b2e918ca2b64ac300186e421aa136e
                                                                                                                                                                                              • Opcode Fuzzy Hash: 1efcefbcc86c02dd90a150c59d1440196e67a4b5fb819cdf1df01e62e384f165
                                                                                                                                                                                              • Instruction Fuzzy Hash: 2D4144F790121D96CB22EB60EC86FDA777C9F44304F1146E7B515E7242EA30DE858B64
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D97B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 003D97E7
                                                                                                                                                                                              • ___except_validate_context_record.LIBVCRUNTIME ref: 003D97EF
                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 003D9878
                                                                                                                                                                                              • __IsNonwritableInCurrentImage.LIBCMT ref: 003D98A3
                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 003D98F8
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                              • API String ID: 1170836740-1018135373
                                                                                                                                                                                              • Opcode ID: 175d44371df60a017292e36f1bd05da4b815e13bfb8840f2217b2869a643a869
                                                                                                                                                                                              • Instruction ID: 78750938cd9d82dd1b60155e95a7aacc9b9e487824adc951680ca20767eb7bc5
                                                                                                                                                                                              • Opcode Fuzzy Hash: 175d44371df60a017292e36f1bd05da4b815e13bfb8840f2217b2869a643a869
                                                                                                                                                                                              • Instruction Fuzzy Hash: CA41C236E00219EBCF12DF69E880B9EBBB5AF46714F148157E8159B392D7319E05CB90
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003DE6F6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,003DE803,003DC8BB,0000000C,?,00000000,00000000,?,003DE95D,00000021,FlsSetValue,003D2924,003D292C,?), ref: 003DE7B7
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FreeLibrary
                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                              • API String ID: 3664257935-537541572
                                                                                                                                                                                              • Opcode ID: fe9f8ef86d9b24c5e40db6c481dbdace1d2a9219e619988077c67b55c2663283
                                                                                                                                                                                              • Instruction ID: 25de04a33426e904e0b62f9cf14474511f8e6cf0fbaec3ab9833bbce29108918
                                                                                                                                                                                              • Opcode Fuzzy Hash: fe9f8ef86d9b24c5e40db6c481dbdace1d2a9219e619988077c67b55c2663283
                                                                                                                                                                                              • Instruction Fuzzy Hash: AD21A873A01251A7CB73AB64BC85A5A3B6CEF51760F260212E915AF3D1E730EE00C690
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D9B32 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,003D9B29,003D9ABA,003D7D97), ref: 003D9B40
                                                                                                                                                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 003D9B4E
                                                                                                                                                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003D9B67
                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,003D9B29,003D9ABA,003D7D97), ref: 003D9BB9
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3852720340-0
                                                                                                                                                                                              • Opcode ID: d39f6fc7cff482514c9b131a3c644485ef0aade4954e54b1ab1746bf1cc73623
                                                                                                                                                                                              • Instruction ID: 8846e63a0cb2f4df79bcb68c9efdee98de8faa306534d924e1494f65f91c8d11
                                                                                                                                                                                              • Opcode Fuzzy Hash: d39f6fc7cff482514c9b131a3c644485ef0aade4954e54b1ab1746bf1cc73623
                                                                                                                                                                                              • Instruction Fuzzy Hash: FB01713321E7116EE63727747CD5B662B6CFB61BBAB22032BF510893E1EE625C119180
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D9E17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,003D9ED8,?,?,003E5CEC,00000000,?,003DA003,00000004,InitializeCriticalSectionEx,003D1C14,InitializeCriticalSectionEx,00000000), ref: 003D9EA7
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FreeLibrary
                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                              • API String ID: 3664257935-2084034818
                                                                                                                                                                                              • Opcode ID: 0dbf24976361c3b83622f1b323146f7487a49d130ac4184a8564b9badfa6392c
                                                                                                                                                                                              • Instruction ID: 0eaa81ba9886565e31d062095f0e806eae8e4fc12fcccfc5a592f418e631c8a1
                                                                                                                                                                                              • Opcode Fuzzy Hash: 0dbf24976361c3b83622f1b323146f7487a49d130ac4184a8564b9badfa6392c
                                                                                                                                                                                              • Instruction Fuzzy Hash: 0A115E73A45625ABDB338BA8BC45B5A73A8AB41760F160653E941AB3D0D760EE008BD1
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D664F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53memoryCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetProcessHeap.KERNEL32(?,?,003D6DDF,?,003D6898), ref: 003D6692
                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 003D66B9
                                                                                                                                                                                                • Part of subcall function 003D750B: EnterCriticalSection.KERNEL32(003E592C,003E64A0,?,?,003D6688,003E64A0,?,?,003D6DDF,?,003D6898), ref: 003D7516
                                                                                                                                                                                                • Part of subcall function 003D750B: LeaveCriticalSection.KERNEL32(003E592C,?,003D6688,003E64A0,?,?,003D6DDF,?,003D6898), ref: 003D7553
                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 003D671B
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CriticalInit_thread_footerSection$EnterHeapLeaveProcess
                                                                                                                                                                                              • String ID: 'g=$]=
                                                                                                                                                                                              • API String ID: 3363689876-4199603549
                                                                                                                                                                                              • Opcode ID: 175e04a944cafc7ed60a7d68ea85af5e8ea58f108e67fdcf97a76b828728e588
                                                                                                                                                                                              • Instruction ID: 3fdb7b536df0a2b93254589b57d2e0cafc363e676806916bc7e2d9c042d6ac53
                                                                                                                                                                                              • Opcode Fuzzy Hash: 175e04a944cafc7ed60a7d68ea85af5e8ea58f108e67fdcf97a76b828728e588
                                                                                                                                                                                              • Instruction Fuzzy Hash: 141179735086919EC7239B26FC8BA5837A8A721BB5F10031AE0148E3E2E73468059F21
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003DBF1A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,89ABB79D,?,?,00000000,003E44E2,000000FF,?,003DBEED,?,?,003DBEC1,?), ref: 003DBF4F
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 003DBF61
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,00000000,003E44E2,000000FF,?,003DBEED,?,?,003DBEC1,?), ref: 003DBF83
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                              • Opcode ID: 90de9a07a03614e00f3e2d22a71771c09f3c533ca6bc0b999124070ac539b299
                                                                                                                                                                                              • Instruction ID: 4345433bb2324d715e60d532a9d44b5a83b686e66a42991b21230718e9210487
                                                                                                                                                                                              • Opcode Fuzzy Hash: 90de9a07a03614e00f3e2d22a71771c09f3c533ca6bc0b999124070ac539b299
                                                                                                                                                                                              • Instruction Fuzzy Hash: 12014F76A08656EBDB278F50EC45BAEBBBCFB04B11F014626F811A63D0DB749D00CA90
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D7593 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • SleepConditionVariableCS.KERNELBASE(?,003D7530,00000064), ref: 003D75B6
                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(003E592C,?,?,003D7530,00000064,?,003D6688,003E64A0,?,?,003D6DDF,?,003D6898), ref: 003D75C0
                                                                                                                                                                                              • WaitForSingleObjectEx.KERNEL32(?,00000000,?,003D7530,00000064,?,003D6688,003E64A0,?,?,003D6DDF,?,003D6898), ref: 003D75D1
                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(003E592C,?,003D7530,00000064,?,003D6688,003E64A0,?,?,003D6DDF,?,003D6898), ref: 003D75D8
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                                              • String ID: ,Y>
                                                                                                                                                                                              • API String ID: 3269011525-1678679328
                                                                                                                                                                                              • Opcode ID: c9bdddd190abccf51ba09d124dc1c47a27c43be224e62e934767a8f8a7273c7e
                                                                                                                                                                                              • Instruction ID: 57d7e8324d2b0f8046c9cd32fa32294d5f121a359709afa3a527489bf0c4b2bc
                                                                                                                                                                                              • Opcode Fuzzy Hash: c9bdddd190abccf51ba09d124dc1c47a27c43be224e62e934767a8f8a7273c7e
                                                                                                                                                                                              • Instruction Fuzzy Hash: 10E06D36505AA4FBCB232B51BC48AEE3F2EEB09775F000211F9095A2E287610D108BD1
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003E0BC0 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • __alloca_probe_16.LIBCMT ref: 003E0C47
                                                                                                                                                                                              • __alloca_probe_16.LIBCMT ref: 003E0D08
                                                                                                                                                                                              • __freea.LIBCMT ref: 003E0D6F
                                                                                                                                                                                                • Part of subcall function 003DFAC8: HeapAlloc.KERNEL32(00000000,00000000,003DC8BB,?,003DD5AD,?,00000000,?,003DBB6F,00000000,003DC8BB,00000004,?,00000000,?,003DC6B5), ref: 003DFAFA
                                                                                                                                                                                              • __freea.LIBCMT ref: 003E0D84
                                                                                                                                                                                              • __freea.LIBCMT ref: 003E0D94
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: __freea$__alloca_probe_16$AllocHeap
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1096550386-0
                                                                                                                                                                                              • Opcode ID: dfe5485159fc3336a90f0df1fc371446191057dff78d6ba60c5c01e873b9f658
                                                                                                                                                                                              • Instruction ID: ae3e90adc2fe0a187e75dfe19a72057ab36105710a4fdfb0ba6db5c0dfe9ad2c
                                                                                                                                                                                              • Opcode Fuzzy Hash: dfe5485159fc3336a90f0df1fc371446191057dff78d6ba60c5c01e873b9f658
                                                                                                                                                                                              • Instruction Fuzzy Hash: EE51C972500166AFDF1A5FA5DC81DBF77A9DF04754B160329FC04DA290E7B0DC9087A0
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003E0FA1 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetConsoleOutputCP.KERNEL32(89ABB79D,?,00000000,?), ref: 003E1004
                                                                                                                                                                                                • Part of subcall function 003DE586: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003E0D65,?,00000000,-00000008), ref: 003DE632
                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 003E125F
                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 003E12A7
                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 003E134A
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2112829910-0
                                                                                                                                                                                              • Opcode ID: 569f913d3ea89e0e4abe28828825f9a6dbe54e21c84bdcd4b08eb58fd9f99f49
                                                                                                                                                                                              • Instruction ID: 0c0127c523e4d8ce40d487675670c3eb679510eae1c1b965aec74f557b0e136c
                                                                                                                                                                                              • Opcode Fuzzy Hash: 569f913d3ea89e0e4abe28828825f9a6dbe54e21c84bdcd4b08eb58fd9f99f49
                                                                                                                                                                                              • Instruction Fuzzy Hash: 8FD14B75D042A89FCF16CFE9D8809ADBBB9FF09310F18462AE556EB391D730A941CB50
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003DA419 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AdjustPointer
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1740715915-0
                                                                                                                                                                                              • Opcode ID: 78248256ab474365d1430a8467f1ec765b7b92b6e9381c5ac38c718ad30b4d38
                                                                                                                                                                                              • Instruction ID: aa940e27b51ce12ec726eedea54c8846266ed3ea987116f568c218580e0082c5
                                                                                                                                                                                              • Opcode Fuzzy Hash: 78248256ab474365d1430a8467f1ec765b7b92b6e9381c5ac38c718ad30b4d38
                                                                                                                                                                                              • Instruction Fuzzy Hash: A251E073A01A029FDB2B9F55FA41B6A77B6FF45310F15412BE8428A390E770ED40CB92
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003E27B6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,003E1F6A,?,00000001,?,?,?,003E139E,?,?,00000000), ref: 003E27CD
                                                                                                                                                                                              • GetLastError.KERNEL32(?,003E1F6A,?,00000001,?,?,?,003E139E,?,?,00000000,?,?,?,003E1925,?), ref: 003E27D9
                                                                                                                                                                                                • Part of subcall function 003E279F: CloseHandle.KERNEL32(FFFFFFFE,003E27E9,?,003E1F6A,?,00000001,?,?,?,003E139E,?,?,00000000,?,?), ref: 003E27AF
                                                                                                                                                                                              • ___initconout.LIBCMT ref: 003E27E9
                                                                                                                                                                                                • Part of subcall function 003E2761: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,003E2790,003E1F57,?,?,003E139E,?,?,00000000,?), ref: 003E2774
                                                                                                                                                                                              • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,003E1F6A,?,00000001,?,?,?,003E139E,?,?,00000000,?), ref: 003E27FE
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2744216297-0
                                                                                                                                                                                              • Opcode ID: 0c937c67c70fb8664e76f4ab51486e6dd5de1a21fffdb51d83e11e178c098e37
                                                                                                                                                                                              • Instruction ID: 66816d6ab31fe67aa0e4d8f48a0920eea94920bff802e9b9bfea4bbe82117412
                                                                                                                                                                                              • Opcode Fuzzy Hash: 0c937c67c70fb8664e76f4ab51486e6dd5de1a21fffdb51d83e11e178c098e37
                                                                                                                                                                                              • Instruction Fuzzy Hash: CFF0A2365012B4BBCF332F96DC44A9A3F69FB08361F054250FD19991B1C631D921DB91
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003DAA1A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 003DAA3F
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: EncodePointer
                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                              • API String ID: 2118026453-2084237596
                                                                                                                                                                                              • Opcode ID: 87d1fe37b3f23be01e5741a94a85df2eb8b7f5de99699cbe40b9e19844a9e7ad
                                                                                                                                                                                              • Instruction ID: 8b53801f3b0f3e51a9d620a70b614eeff9b6103f47e2ae0b79465bd63ced82d7
                                                                                                                                                                                              • Opcode Fuzzy Hash: 87d1fe37b3f23be01e5741a94a85df2eb8b7f5de99699cbe40b9e19844a9e7ad
                                                                                                                                                                                              • Instruction Fuzzy Hash: D7417C32900509AFCF16CFA8EE81AEEBBB6FF08304F19815AF9046B211D3759951DB52
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D69EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61registryCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • RegOpenKeyExW.ADVAPI32(?,Software\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019},00000000,00020019,?,?,?), ref: 003D6A15
                                                                                                                                                                                              • SHQueryValueExW.SHLWAPI(?,003D5D10,00000000,?,00000000,?,00000032,?,?), ref: 003D6A58
                                                                                                                                                                                              Strings
                                                                                                                                                                                              • Software\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}, xrefs: 003D6A07
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: OpenQueryValue
                                                                                                                                                                                              • String ID: Software\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}
                                                                                                                                                                                              • API String ID: 4153817207-790910960
                                                                                                                                                                                              • Opcode ID: 42c89f68ea85deb0401a2a70f54c0420db5de095dcc7b7c24da87ede63487d7b
                                                                                                                                                                                              • Instruction ID: ea8228ba1220b900b080de6c9fdd39b92e85421cf9ccdc7fbf06404018f94419
                                                                                                                                                                                              • Opcode Fuzzy Hash: 42c89f68ea85deb0401a2a70f54c0420db5de095dcc7b7c24da87ede63487d7b
                                                                                                                                                                                              • Instruction Fuzzy Hash: CD1177B3D40259AB8B219A69AC46DBEBBBDEB40710F104257B861FA290D6748F0087A0
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D73EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 003D7AC1
                                                                                                                                                                                              • ___raise_securityfailure.LIBCMT ref: 003D7BA9
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                                                                                                                              • String ID: xY>
                                                                                                                                                                                              • API String ID: 3761405300-263920460
                                                                                                                                                                                              • Opcode ID: 2e5d3b80a344feeb4c3e6c730d78433c797ec12ac7e76b9bcbd98f9518e68c62
                                                                                                                                                                                              • Instruction ID: 8ea452b1db784382d026aa476a2ff5c450341d1e4d7c0513d078f0e088368ff8
                                                                                                                                                                                              • Opcode Fuzzy Hash: 2e5d3b80a344feeb4c3e6c730d78433c797ec12ac7e76b9bcbd98f9518e68c62
                                                                                                                                                                                              • Instruction Fuzzy Hash: E821C4B6501A84DED723CF15FCD5A847BA8BB08318F50572AE6098FBE1E3B49981CF44
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D6F7D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                                • Part of subcall function 003D7387: EnterCriticalSection.KERNEL32(003E58FC,?,?,?,003D6F92,00000000,?,?,00000000,?,?,003D6912,-00000010), ref: 003D7392
                                                                                                                                                                                                • Part of subcall function 003D7387: LeaveCriticalSection.KERNEL32(003E58FC,?,?,?,003D6F92,00000000,?,?,00000000,?,?,003D6912,-00000010), ref: 003D73BE
                                                                                                                                                                                              • FindResourceExW.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,00000000,?,?,003D6912,-00000010), ref: 003D6FAE
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CriticalSection$EnterFindLeaveResource
                                                                                                                                                                                              • String ID: X>$X>
                                                                                                                                                                                              • API String ID: 2190064429-1781451225
                                                                                                                                                                                              • Opcode ID: 32e0b2503690e44f88323e84930f03d32b9096248656b5759e282d6787c95a05
                                                                                                                                                                                              • Instruction ID: cde43eb0b060bb2d5d2b82e82606be94d34159e2cbd46eac6ad5687a83182d1b
                                                                                                                                                                                              • Opcode Fuzzy Hash: 32e0b2503690e44f88323e84930f03d32b9096248656b5759e282d6787c95a05
                                                                                                                                                                                              • Instruction Fuzzy Hash: 1701F233B09A2027D7275719BC52B3EA6ADDB91B94F11013BFD02EB380EE60CD0161E0
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 003D72D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                                • Part of subcall function 003D6511: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 003D6516
                                                                                                                                                                                                • Part of subcall function 003D6511: GetLastError.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 003D6520
                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32(?,?,?,003D648A), ref: 003D7309
                                                                                                                                                                                              • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,003D648A), ref: 003D7318
                                                                                                                                                                                              Strings
                                                                                                                                                                                              • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 003D7313
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000001.00000002.2411645138.00000000003D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000001.00000002.2411590357.00000000003D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411725769.00000000003E5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000001.00000002.2411898028.00000000003E7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_3d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                                                                                                                              • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                              • API String ID: 450123788-631824599
                                                                                                                                                                                              • Opcode ID: 50f43eccb85ba2a117f9648726d55f1b7a80a71bed8ac5e888c6eeeb9457d386
                                                                                                                                                                                              • Instruction ID: 62d281e24401d27f01c583b33ac1efc32a93cede500c7ce602bbda7ebefbfdad
                                                                                                                                                                                              • Opcode Fuzzy Hash: 50f43eccb85ba2a117f9648726d55f1b7a80a71bed8ac5e888c6eeeb9457d386
                                                                                                                                                                                              • Instruction Fuzzy Hash: F5E09B762043808BD3739F75F90534677E89F00754F00895FE895C6381E7B4D548CB91
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                              Execution Coverage:4.1%
                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                              Signature Coverage:0%
                                                                                                                                                                                              Total number of Nodes:1999
                                                                                                                                                                                              Total number of Limit Nodes:20
                                                                                                                                                                                              execution_graph 9423 9dc01c 9424 9dc033 9423->9424 9432 9dc02c 9423->9432 9425 9dc054 GetModuleFileNameW 9424->9425 9426 9dc03e 9424->9426 9429 9dc079 9425->9429 9427 9dbaf8 __freea 14 API calls 9426->9427 9428 9dc043 9427->9428 9430 9dba3a ___std_exception_copy 41 API calls 9428->9430 9446 9dc2f3 9429->9446 9430->9432 9434 9dc0af 9435 9dbaf8 __freea 14 API calls 9434->9435 9436 9dc0b4 9435->9436 9439 9dd52b __freea 14 API calls 9436->9439 9437 9dc0bb 9437->9436 9438 9dc0f5 9437->9438 9440 9dc10c 9438->9440 9441 9dc116 9438->9441 9439->9432 9442 9dd52b __freea 14 API calls 9440->9442 9444 9dd52b __freea 14 API calls 9441->9444 9443 9dc114 9442->9443 9445 9dd52b __freea 14 API calls 9443->9445 9444->9443 9445->9432 9447 9dc0a6 9446->9447 9448 9dc304 9446->9448 9447->9434 9447->9437 9448->9447 9449 9dd6d2 _unexpected 14 API calls 9448->9449 9450 9dc32d 9449->9450 9451 9dd52b __freea 14 API calls 9450->9451 9451->9447 8398 9df39e 8399 9df3ab 8398->8399 8400 9dd6d2 _unexpected 14 API calls 8399->8400 8401 9df3c5 8400->8401 8402 9dd52b __freea 14 API calls 8401->8402 8403 9df3d1 8402->8403 8404 9dd6d2 _unexpected 14 API calls 8403->8404 8408 9df3f7 8403->8408 8405 9df3eb 8404->8405 8407 9dd52b __freea 14 API calls 8405->8407 8406 9de983 6 API calls 8406->8408 8407->8408 8408->8406 8409 9df403 8408->8409 9452 9e2a1a IsProcessorFeaturePresent 9453 9d6618 HeapSize 8410 9d6491 8411 9d64a0 RaiseException 8410->8411 8412 9db08d 8418 9db02f __CallSettingFrame@12 __FrameHandler3::FrameUnwindToState 8412->8418 8413 9db0a8 8415 9dcd36 CallUnexpected 41 API calls 8413->8415 8417 9db0ad __FrameHandler3::FrameUnwindToState 8413->8417 8416 9db0e8 8415->8416 8418->8413 8419 9db0cf 8418->8419 8424 9d9b24 8419->8424 8421 9db0d4 8422 9db0df 8421->8422 8423 9d9b24 CallUnexpected 51 API calls 8421->8423 8422->8413 8423->8422 8437 9d9b32 8424->8437 8426 9d9b29 8426->8421 8451 9deeb2 8426->8451 8430 9dcd50 IsProcessorFeaturePresent 8433 9dcd5c 8430->8433 8431 9dcd6f 8434 9dbfc9 CallUnexpected 23 API calls 8431->8434 8432 9dcd46 8432->8430 8432->8431 8435 9db83e CallUnexpected 8 API calls 8433->8435 8436 9dcd79 8434->8436 8435->8431 8438 9d9b3e GetLastError 8437->8438 8439 9d9b3b 8437->8439 8481 9d9f70 8438->8481 8439->8426 8442 9d9b72 8443 9d9bb8 SetLastError 8442->8443 8443->8426 8444 9d9fab ___vcrt_FlsSetValue 6 API calls 8445 9d9b6c CallUnexpected 8444->8445 8445->8442 8446 9d9b94 8445->8446 8447 9d9fab ___vcrt_FlsSetValue 6 API calls 8445->8447 8448 9d9fab ___vcrt_FlsSetValue 6 API calls 8446->8448 8449 9d9ba8 8446->8449 8447->8446 8448->8449 8486 9dbb0b 8449->8486 8489 9dede4 8451->8489 8454 9deef7 8455 9def03 CallCatchBlock 8454->8455 8456 9def30 CallUnexpected 8455->8456 8457 9dd391 __freea 14 API calls 8455->8457 8460 9def2a CallUnexpected 8455->8460 8463 9defa3 8456->8463 8500 9dd642 EnterCriticalSection 8456->8500 8457->8460 8458 9def77 8459 9dbaf8 __freea 14 API calls 8458->8459 8461 9def7c 8459->8461 8460->8456 8460->8458 8470 9def61 8460->8470 8462 9dba3a ___std_exception_copy 41 API calls 8461->8462 8462->8470 8466 9defe5 8463->8466 8467 9df0d6 8463->8467 8478 9df014 8463->8478 8473 9dd240 _unexpected 41 API calls 8466->8473 8466->8478 8469 9df0e1 8467->8469 8505 9dd68a LeaveCriticalSection 8467->8505 8472 9dbfc9 CallUnexpected 23 API calls 8469->8472 8470->8432 8474 9df0e9 8472->8474 8476 9df009 8473->8476 8475 9dd240 _unexpected 41 API calls 8479 9df069 8475->8479 8477 9dd240 _unexpected 41 API calls 8476->8477 8477->8478 8501 9df083 8478->8501 8479->8470 8480 9dd240 _unexpected 41 API calls 8479->8480 8480->8470 8482 9d9eb1 ___vcrt_InitializeCriticalSectionEx 5 API calls 8481->8482 8483 9d9f8a 8482->8483 8484 9d9fa2 TlsGetValue 8483->8484 8485 9d9b53 8483->8485 8484->8485 8485->8442 8485->8443 8485->8444 8487 9dd52b __freea 14 API calls 8486->8487 8488 9dbb23 8487->8488 8488->8442 8490 9dedf0 CallCatchBlock 8489->8490 8495 9dd642 EnterCriticalSection 8490->8495 8492 9dedfe 8496 9dee3c 8492->8496 8495->8492 8499 9dd68a LeaveCriticalSection 8496->8499 8498 9dcd3b 8498->8432 8498->8454 8499->8498 8500->8463 8502 9df089 8501->8502 8503 9df05a 8501->8503 8506 9dd68a LeaveCriticalSection 8502->8506 8503->8470 8503->8475 8503->8479 8505->8469 8506->8503 9454 9d9b08 9455 9d9b1f 9454->9455 9456 9d9b12 9454->9456 9456->9455 9457 9dbb0b ___std_exception_copy 14 API calls 9456->9457 9457->9455 7458 9d7905 7459 9d7911 CallCatchBlock 7458->7459 7484 9d7657 7459->7484 7461 9d7918 7462 9d7a6b 7461->7462 7473 9d7942 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock CallUnexpected 7461->7473 7535 9d7bb0 IsProcessorFeaturePresent 7462->7535 7464 9d7a72 7515 9dc006 7464->7515 7469 9d7961 7470 9d79e2 7495 9d7ccb 7470->7495 7472 9d79e8 7499 9d6c1e GetModuleHandleW GetProcAddress 7472->7499 7473->7469 7473->7470 7518 9dbfe0 7473->7518 7476 9d79fd 7524 9d7d04 GetModuleHandleW 7476->7524 7479 9d7a08 7480 9d7a11 7479->7480 7526 9dbfba 7479->7526 7529 9d77c8 7480->7529 7485 9d7660 7484->7485 7542 9d7db1 IsProcessorFeaturePresent 7485->7542 7489 9d7671 7490 9d7675 7489->7490 7552 9dc9b8 7489->7552 7490->7461 7493 9d768c 7493->7461 7870 9d95e0 7495->7870 7498 9d7cf1 7498->7472 7500 9d6c3d 7499->7500 7872 9d6887 7500->7872 7502 9d6c4c 7899 9d6dd7 7502->7899 7504 9d6c56 7902 9d6a8c 7504->7902 7507 9d6c6b LoadLibraryExW 7509 9d6c7e 7507->7509 7510 9d6c87 GetProcAddress 7507->7510 7508 9d6c83 7508->7476 7933 9d6820 GetLastError 7509->7933 7512 9d6ca5 FreeLibrary 7510->7512 7513 9d6c99 GetCommandLineW 7510->7513 7512->7508 7513->7512 8148 9dbe30 7515->8148 7519 9dbff6 _unexpected CallCatchBlock 7518->7519 7519->7470 8223 9dd240 GetLastError 7519->8223 7521 9dcd36 CallUnexpected 41 API calls 7522 9dccd6 7521->7522 7525 9d7a04 7524->7525 7525->7464 7525->7479 7527 9dbe30 CallUnexpected 23 API calls 7526->7527 7528 9dbfc5 7527->7528 7528->7480 7530 9d77d4 7529->7530 7531 9d77ea 7530->7531 8250 9dc9ca 7530->8250 7531->7469 7533 9d77e2 7534 9d9759 ___scrt_uninitialize_crt 7 API calls 7533->7534 7534->7531 7536 9d7bc6 CallUnexpected 7535->7536 7537 9d7c71 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7536->7537 7538 9d7cbc CallUnexpected 7537->7538 7538->7464 7539 9dbfc9 7540 9dbe30 CallUnexpected 23 API calls 7539->7540 7541 9d7a80 7540->7541 7543 9d766c 7542->7543 7544 9d973a 7543->7544 7561 9d9c12 7544->7561 7548 9d974b 7549 9d9756 7548->7549 7575 9d9c4e 7548->7575 7549->7489 7551 9d9743 7551->7489 7617 9decb3 7552->7617 7555 9d9759 7556 9d976c 7555->7556 7557 9d9762 7555->7557 7556->7490 7558 9d9bf7 ___vcrt_uninitialize_ptd 6 API calls 7557->7558 7559 9d9767 7558->7559 7560 9d9c4e ___vcrt_uninitialize_locks DeleteCriticalSection 7559->7560 7560->7556 7563 9d9c1b 7561->7563 7564 9d9c44 7563->7564 7565 9d973f 7563->7565 7579 9d9fe9 7563->7579 7566 9d9c4e ___vcrt_uninitialize_locks DeleteCriticalSection 7564->7566 7565->7551 7567 9d9bc4 7565->7567 7566->7565 7598 9d9efa 7567->7598 7570 9d9bd9 7570->7548 7573 9d9bf4 7573->7548 7576 9d9c78 7575->7576 7577 9d9c59 7575->7577 7576->7551 7578 9d9c63 DeleteCriticalSection 7577->7578 7578->7576 7578->7578 7584 9d9eb1 7579->7584 7582 9da021 InitializeCriticalSectionAndSpinCount 7583 9da00c 7582->7583 7583->7563 7585 9d9ec9 7584->7585 7586 9d9eec 7584->7586 7585->7586 7590 9d9e17 7585->7590 7586->7582 7586->7583 7589 9d9ede GetProcAddress 7589->7586 7596 9d9e23 ___vcrt_InitializeCriticalSectionEx 7590->7596 7591 9d9e97 7591->7586 7591->7589 7592 9d9e39 LoadLibraryExW 7593 9d9e9e 7592->7593 7594 9d9e57 GetLastError 7592->7594 7593->7591 7595 9d9ea6 FreeLibrary 7593->7595 7594->7596 7595->7591 7596->7591 7596->7592 7597 9d9e79 LoadLibraryExW 7596->7597 7597->7593 7597->7596 7599 9d9eb1 ___vcrt_InitializeCriticalSectionEx 5 API calls 7598->7599 7600 9d9f14 7599->7600 7601 9d9f2d TlsAlloc 7600->7601 7602 9d9bce 7600->7602 7602->7570 7603 9d9fab 7602->7603 7604 9d9eb1 ___vcrt_InitializeCriticalSectionEx 5 API calls 7603->7604 7605 9d9fc5 7604->7605 7606 9d9fe0 TlsSetValue 7605->7606 7607 9d9be7 7605->7607 7606->7607 7607->7573 7608 9d9bf7 7607->7608 7609 9d9c07 7608->7609 7610 9d9c01 7608->7610 7609->7570 7612 9d9f35 7610->7612 7613 9d9eb1 ___vcrt_InitializeCriticalSectionEx 5 API calls 7612->7613 7614 9d9f4f 7613->7614 7615 9d9f67 TlsFree 7614->7615 7616 9d9f5b 7614->7616 7615->7616 7616->7609 7618 9decc3 7617->7618 7619 9d767e 7617->7619 7618->7619 7621 9dec27 7618->7621 7619->7493 7619->7555 7622 9dec33 CallCatchBlock 7621->7622 7633 9dd642 EnterCriticalSection 7622->7633 7624 9dec3a 7634 9df663 7624->7634 7627 9dec58 7658 9dec7e 7627->7658 7633->7624 7635 9df66f CallCatchBlock 7634->7635 7636 9df699 7635->7636 7637 9df678 7635->7637 7661 9dd642 EnterCriticalSection 7636->7661 7669 9dbaf8 7637->7669 7641 9df6a5 7646 9df6d1 7641->7646 7662 9df5b3 7641->7662 7644 9dec49 7644->7627 7647 9deac1 GetStartupInfoW 7644->7647 7675 9df6f8 7646->7675 7648 9deade 7647->7648 7649 9deb72 7647->7649 7648->7649 7650 9df663 42 API calls 7648->7650 7653 9deb77 7649->7653 7651 9deb06 7650->7651 7651->7649 7652 9deb36 GetFileType 7651->7652 7652->7651 7654 9deb7e 7653->7654 7655 9debc1 GetStdHandle 7654->7655 7656 9dec23 7654->7656 7657 9debd4 GetFileType 7654->7657 7655->7654 7656->7627 7657->7654 7869 9dd68a LeaveCriticalSection 7658->7869 7660 9dec69 7660->7618 7661->7641 7678 9dd6d2 7662->7678 7664 9df5c5 7668 9df5d2 7664->7668 7685 9de983 7664->7685 7690 9dd52b 7668->7690 7724 9dd391 GetLastError 7669->7724 7671 9dbafd 7672 9dba3a 7671->7672 7788 9db986 7672->7788 7868 9dd68a LeaveCriticalSection 7675->7868 7677 9df6ff 7677->7644 7679 9dd6df _unexpected 7678->7679 7680 9dd71f 7679->7680 7681 9dd70a RtlAllocateHeap 7679->7681 7696 9ded5b 7679->7696 7682 9dbaf8 __freea 13 API calls 7680->7682 7681->7679 7683 9dd71d 7681->7683 7682->7683 7683->7664 7709 9de7c1 7685->7709 7688 9de9bd InitializeCriticalSectionAndSpinCount 7689 9de9a8 7688->7689 7689->7664 7691 9dd536 HeapFree 7690->7691 7692 9dd560 7690->7692 7691->7692 7693 9dd54b GetLastError 7691->7693 7692->7641 7694 9dd558 __freea 7693->7694 7695 9dbaf8 __freea 12 API calls 7694->7695 7695->7692 7699 9ded88 7696->7699 7700 9ded94 CallCatchBlock 7699->7700 7705 9dd642 EnterCriticalSection 7700->7705 7702 9ded9f 7706 9deddb 7702->7706 7705->7702 7707 9dd68a CallUnexpected LeaveCriticalSection 7706->7707 7708 9ded66 7707->7708 7708->7679 7710 9de7ef 7709->7710 7711 9de7eb 7709->7711 7710->7711 7716 9de6f6 7710->7716 7711->7688 7711->7689 7714 9de809 GetProcAddress 7714->7711 7715 9de819 _unexpected 7714->7715 7715->7711 7722 9de707 ___vcrt_InitializeCriticalSectionEx 7716->7722 7717 9de79d 7717->7711 7717->7714 7718 9de725 LoadLibraryExW 7719 9de7a4 7718->7719 7720 9de740 GetLastError 7718->7720 7719->7717 7721 9de7b6 FreeLibrary 7719->7721 7720->7722 7721->7717 7722->7717 7722->7718 7723 9de773 LoadLibraryExW 7722->7723 7723->7719 7723->7722 7725 9dd3a7 7724->7725 7726 9dd3ad 7724->7726 7747 9de902 7725->7747 7730 9dd3b1 SetLastError 7726->7730 7752 9de941 7726->7752 7730->7671 7732 9dd6d2 _unexpected 12 API calls 7733 9dd3de 7732->7733 7734 9dd3f7 7733->7734 7735 9dd3e6 7733->7735 7736 9de941 _unexpected 6 API calls 7734->7736 7737 9de941 _unexpected 6 API calls 7735->7737 7738 9dd403 7736->7738 7739 9dd3f4 7737->7739 7740 9dd41e 7738->7740 7741 9dd407 7738->7741 7743 9dd52b __freea 12 API calls 7739->7743 7757 9dd06e 7740->7757 7742 9de941 _unexpected 6 API calls 7741->7742 7742->7739 7743->7730 7746 9dd52b __freea 12 API calls 7746->7730 7748 9de7c1 _unexpected 5 API calls 7747->7748 7749 9de91e 7748->7749 7750 9de939 TlsGetValue 7749->7750 7751 9de927 7749->7751 7751->7726 7753 9de7c1 _unexpected 5 API calls 7752->7753 7754 9de95d 7753->7754 7755 9de97b TlsSetValue 7754->7755 7756 9dd3c9 7754->7756 7756->7730 7756->7732 7762 9dcf02 7757->7762 7763 9dcf0e CallCatchBlock 7762->7763 7776 9dd642 EnterCriticalSection 7763->7776 7765 9dcf18 7777 9dcf48 7765->7777 7768 9dd014 7769 9dd020 CallCatchBlock 7768->7769 7780 9dd642 EnterCriticalSection 7769->7780 7771 9dd02a 7781 9dd1f5 7771->7781 7773 9dd042 7785 9dd062 7773->7785 7776->7765 7778 9dd68a CallUnexpected LeaveCriticalSection 7777->7778 7779 9dcf36 7778->7779 7779->7768 7780->7771 7782 9dd22b _unexpected 7781->7782 7783 9dd204 _unexpected 7781->7783 7782->7773 7783->7782 7784 9dfd0a _unexpected 14 API calls 7783->7784 7784->7782 7786 9dd68a CallUnexpected LeaveCriticalSection 7785->7786 7787 9dd050 7786->7787 7787->7746 7789 9db998 ___std_exception_copy 7788->7789 7794 9db9bd 7789->7794 7791 9db9b0 7805 9db776 7791->7805 7795 9db9cd 7794->7795 7796 9db9d4 7794->7796 7811 9db7db GetLastError 7795->7811 7802 9db9e2 7796->7802 7815 9db7b2 7796->7815 7799 9dba09 7799->7802 7818 9dba4a IsProcessorFeaturePresent 7799->7818 7801 9dba39 7803 9db986 ___std_exception_copy 41 API calls 7801->7803 7802->7791 7804 9dba46 7803->7804 7804->7791 7806 9db782 7805->7806 7809 9db799 7806->7809 7850 9db821 7806->7850 7808 9db7ac 7808->7644 7809->7808 7810 9db821 ___std_exception_copy 41 API calls 7809->7810 7810->7808 7812 9db7f4 7811->7812 7822 9dd442 7812->7822 7816 9db7bd GetLastError SetLastError 7815->7816 7817 9db7d6 7815->7817 7816->7799 7817->7799 7819 9dba56 7818->7819 7844 9db83e 7819->7844 7823 9dd455 7822->7823 7827 9dd45b 7822->7827 7825 9de902 _unexpected 6 API calls 7823->7825 7824 9de941 _unexpected 6 API calls 7826 9dd475 7824->7826 7825->7827 7828 9db80c SetLastError 7826->7828 7829 9dd6d2 _unexpected 14 API calls 7826->7829 7827->7824 7827->7828 7828->7796 7830 9dd485 7829->7830 7831 9dd48d 7830->7831 7832 9dd4a2 7830->7832 7833 9de941 _unexpected 6 API calls 7831->7833 7834 9de941 _unexpected 6 API calls 7832->7834 7835 9dd499 7833->7835 7836 9dd4ae 7834->7836 7841 9dd52b __freea 14 API calls 7835->7841 7837 9dd4c1 7836->7837 7838 9dd4b2 7836->7838 7840 9dd06e _unexpected 14 API calls 7837->7840 7839 9de941 _unexpected 6 API calls 7838->7839 7839->7835 7842 9dd4cc 7840->7842 7841->7828 7843 9dd52b __freea 14 API calls 7842->7843 7843->7828 7845 9db85a CallUnexpected 7844->7845 7846 9db886 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7845->7846 7847 9db957 CallUnexpected 7846->7847 7848 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 7847->7848 7849 9db975 GetCurrentProcess TerminateProcess 7848->7849 7849->7801 7851 9db82b 7850->7851 7852 9db834 7850->7852 7853 9db7db ___std_exception_copy 16 API calls 7851->7853 7852->7809 7854 9db830 7853->7854 7854->7852 7857 9dcd36 7854->7857 7858 9deeb2 CallUnexpected EnterCriticalSection LeaveCriticalSection 7857->7858 7859 9dcd3b 7858->7859 7860 9dcd46 7859->7860 7861 9deef7 CallUnexpected 40 API calls 7859->7861 7862 9dcd50 IsProcessorFeaturePresent 7860->7862 7863 9dcd6f 7860->7863 7861->7860 7864 9dcd5c 7862->7864 7865 9dbfc9 CallUnexpected 23 API calls 7863->7865 7866 9db83e CallUnexpected 8 API calls 7864->7866 7867 9dcd79 7865->7867 7866->7863 7868->7677 7869->7660 7871 9d7cde GetStartupInfoW 7870->7871 7871->7498 7873 9d6dd7 56 API calls 7872->7873 7874 9d6898 7873->7874 7875 9d68b1 GetModuleFileNameW 7874->7875 7876 9d68c9 7875->7876 7897 9d69a0 7876->7897 7935 9d664f 7876->7935 7878 9d69e3 7880 9d6914 7974 9d6eab 7880->7974 7881 9d6906 7965 9d6f7d 7881->7965 7884 9d6912 7950 9d6cc6 7884->7950 7886 9d6931 7954 9d6ffa 7886->7954 7888 9d693c 7958 9d6d76 7888->7958 7890 9d694e 7891 9d6dd7 56 API calls 7890->7891 7892 9d695e 7891->7892 7893 9d6973 SHGetFolderPathW 7892->7893 7894 9d698c 7893->7894 7894->7897 7987 9d6d3c 7894->7987 7896 9d6998 7898 9d6d3c CharLowerBuffW 7896->7898 7897->7502 7898->7897 7900 9d664f 56 API calls 7899->7900 7901 9d6ddf 7900->7901 7901->7504 7903 9d6ac1 CallUnexpected 7902->7903 7904 9d6ad0 GetModuleFileNameW 7903->7904 7905 9d6aeb 7904->7905 7906 9d6af5 PathRemoveFileSpecW 7904->7906 7907 9d6820 GetLastError 7905->7907 8121 9db6ca 7906->8121 7925 9d6af0 7907->7925 7910 9d6b31 8130 9d683b 7910->8130 7913 9d6c1c 7913->7507 7913->7508 7915 9d6b40 7919 9d6eab 41 API calls 7915->7919 7916 9d6b63 7917 9db6ca 41 API calls 7916->7917 7918 9d6b7b 7917->7918 7920 9d6dd7 56 API calls 7918->7920 7919->7925 7921 9d6b89 7920->7921 8136 9d69ee RegOpenKeyExW 7921->8136 7923 9d6b9a 7924 9d6ba0 PathAppendW 7923->7924 7923->7925 7926 9d6bc5 7924->7926 7927 9d6bb3 PathAppendW 7924->7927 8140 9d73ee 7925->8140 7929 9d6820 GetLastError 7926->7929 7927->7926 7928 9d6bce 7927->7928 7930 9d683b 6 API calls 7928->7930 7929->7925 7931 9d6bd9 7930->7931 7931->7925 7932 9d6eab 41 API calls 7931->7932 7932->7925 7934 9d682a 7933->7934 7934->7508 7936 9d667d 7935->7936 7938 9d6666 7935->7938 7992 9d750b EnterCriticalSection 7936->7992 7937 9d6678 7937->7878 7937->7880 7937->7881 7938->7937 7941 9d750b 6 API calls 7938->7941 7940 9d6688 7940->7938 7942 9d6692 GetProcessHeap 7940->7942 7943 9d66cd 7941->7943 7997 9d781d 7942->7997 7943->7937 7945 9d781d 44 API calls 7943->7945 7947 9d671a 7945->7947 7949 9d74c1 __Init_thread_footer 5 API calls 7947->7949 7949->7937 8073 9d6dfe 7950->8073 7952 9d6cd4 PathRemoveFileSpecW 7953 9d6ce3 7952->7953 7953->7886 7955 9d7005 7954->7955 7957 9d7013 7955->7957 8075 9d70a4 7955->8075 7957->7888 7959 9d6d8e 7958->7959 7964 9d6da2 7958->7964 7960 9d6dc3 7959->7960 7962 9d6d9d 7959->7962 7961 9d6eab 41 API calls 7960->7961 7961->7964 7963 9d6ffa 14 API calls 7962->7963 7963->7964 7964->7890 8081 9d7387 EnterCriticalSection 7965->8081 7967 9d6fa8 FindResourceExW 7968 9d6f92 7967->7968 7968->7967 7970 9d7387 5 API calls 7968->7970 7971 9d6fe0 7968->7971 7973 9d6fef 7968->7973 8086 9d6539 LoadResource 7968->8086 7970->7968 7971->7973 8090 9d7118 FindResourceW 7971->8090 7973->7884 7976 9d6ec3 7974->7976 7984 9d6eb9 __InternalCxxFrameHandler 7974->7984 7975 9d6f57 7976->7975 7977 9d6f3d 7976->7977 7978 9d6ef3 7976->7978 7979 9d70a4 14 API calls 7977->7979 7980 9d6f04 7978->7980 7982 9d6f1a 7978->7982 7978->7984 7979->7984 7981 9dbaf8 __freea 14 API calls 7980->7981 7983 9d6f09 7981->7983 7982->7984 7985 9dbaf8 __freea 14 API calls 7982->7985 7986 9dba3a ___std_exception_copy 41 API calls 7983->7986 7984->7884 7985->7983 7986->7984 7988 9d6d4b 7987->7988 7989 9d6d6b 7988->7989 7990 9d6d56 CharLowerBuffW 7988->7990 7991 9d6d66 7990->7991 7991->7896 7996 9d751f 7992->7996 7993 9d7524 LeaveCriticalSection 7993->7940 7996->7993 8005 9d7593 7996->8005 8010 9d77f0 7997->8010 8000 9d74c1 EnterCriticalSection LeaveCriticalSection 8001 9d755d 8000->8001 8002 9d7579 SetEvent ResetEvent 8001->8002 8003 9d7568 RtlWakeAllConditionVariable 8001->8003 8002->7938 8003->7938 8006 9d75ba LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 8005->8006 8007 9d75a1 SleepConditionVariableCS 8005->8007 8008 9d75de 8006->8008 8007->8008 8008->7996 8011 9d77ff 8010->8011 8012 9d7806 8010->8012 8016 9dc80d 8011->8016 8019 9dc88a 8012->8019 8015 9d66b8 8015->8000 8017 9dc88a 44 API calls 8016->8017 8018 9dc81f 8017->8018 8018->8015 8022 9dc5d6 8019->8022 8023 9dc5e2 CallCatchBlock 8022->8023 8030 9dd642 EnterCriticalSection 8023->8030 8025 9dc5f0 8031 9dc631 8025->8031 8027 9dc5fd 8041 9dc625 8027->8041 8030->8025 8032 9dc64c 8031->8032 8033 9dc6bf _unexpected 8031->8033 8032->8033 8034 9dc69f 8032->8034 8044 9dbb26 8032->8044 8033->8027 8034->8033 8035 9dbb26 44 API calls 8034->8035 8037 9dc6b5 8035->8037 8039 9dd52b __freea 14 API calls 8037->8039 8038 9dc695 8040 9dd52b __freea 14 API calls 8038->8040 8039->8033 8040->8034 8072 9dd68a LeaveCriticalSection 8041->8072 8043 9dc60e 8043->8015 8045 9dbb4e 8044->8045 8046 9dbb33 8044->8046 8047 9dbb5d 8045->8047 8053 9dd565 8045->8053 8046->8045 8048 9dbb3f 8046->8048 8060 9dd598 8047->8060 8050 9dbaf8 __freea 14 API calls 8048->8050 8052 9dbb44 CallUnexpected 8050->8052 8052->8038 8054 9dd585 HeapSize 8053->8054 8055 9dd570 8053->8055 8054->8047 8056 9dbaf8 __freea 14 API calls 8055->8056 8057 9dd575 8056->8057 8058 9dba3a ___std_exception_copy 41 API calls 8057->8058 8059 9dd580 8058->8059 8059->8047 8061 9dd5a5 8060->8061 8062 9dd5b0 8060->8062 8063 9dfac8 15 API calls 8061->8063 8064 9dd5b8 8062->8064 8071 9dd5c1 _unexpected 8062->8071 8068 9dd5ad 8063->8068 8065 9dd52b __freea 14 API calls 8064->8065 8065->8068 8066 9dd5eb HeapReAlloc 8066->8068 8066->8071 8067 9dd5c6 8069 9dbaf8 __freea 14 API calls 8067->8069 8068->8052 8069->8068 8070 9ded5b _unexpected EnterCriticalSection LeaveCriticalSection 8070->8071 8071->8066 8071->8067 8071->8070 8072->8043 8074 9d6e2f 8073->8074 8076 9d70b6 8075->8076 8079 9d70d9 __InternalCxxFrameHandler 8075->8079 8077 9d70bf CallUnexpected 8076->8077 8078 9dbaf8 __freea 14 API calls 8076->8078 8077->8079 8080 9dbaf8 14 API calls __freea 8077->8080 8078->8077 8079->7957 8080->8077 8082 9d73a9 LeaveCriticalSection 8081->8082 8083 9d73a0 8081->8083 8082->7968 8083->8082 8096 9d7362 8083->8096 8087 9d656f 8086->8087 8088 9d654f LockResource 8086->8088 8087->7968 8088->8087 8089 9d655c SizeofResource 8088->8089 8089->8087 8091 9d7168 8090->8091 8092 9d7139 8090->8092 8091->7973 8093 9d6539 3 API calls 8092->8093 8094 9d7146 8093->8094 8094->8091 8107 9db61a 8094->8107 8097 9d736c 8096->8097 8099 9d7371 8097->8099 8106 9d64a0 RaiseException 8097->8106 8099->8082 8100 9d7386 EnterCriticalSection 8102 9d73a0 8100->8102 8105 9d73a9 LeaveCriticalSection 8100->8105 8104 9d7362 RaiseException 8102->8104 8102->8105 8104->8105 8105->8082 8106->8100 8108 9db62b 8107->8108 8117 9db627 __InternalCxxFrameHandler 8107->8117 8109 9db632 8108->8109 8111 9db645 _wmemset 8108->8111 8110 9dbaf8 __freea 14 API calls 8109->8110 8112 9db637 8110->8112 8114 9db67f 8111->8114 8115 9db676 8111->8115 8111->8117 8113 9dba3a ___std_exception_copy 41 API calls 8112->8113 8113->8117 8114->8117 8119 9dbaf8 __freea 14 API calls 8114->8119 8116 9dbaf8 __freea 14 API calls 8115->8116 8118 9db67b 8116->8118 8117->8091 8120 9dba3a ___std_exception_copy 41 API calls 8118->8120 8119->8118 8120->8117 8122 9db6d8 8121->8122 8123 9db6e6 8121->8123 8122->8123 8128 9db700 8122->8128 8124 9dbaf8 __freea 14 API calls 8123->8124 8125 9db6f0 8124->8125 8127 9dba3a ___std_exception_copy 41 API calls 8125->8127 8126 9d6b16 PathAppendW 8126->7905 8126->7910 8127->8126 8128->8126 8129 9dbaf8 __freea 14 API calls 8128->8129 8129->8125 8131 9d6878 8130->8131 8132 9d6852 8130->8132 8134 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 8131->8134 8132->8131 8133 9d6859 GetFileAttributesExW 8132->8133 8133->8131 8135 9d6885 8134->8135 8135->7915 8135->7916 8137 9d6a1f 8136->8137 8138 9d6a2b 8136->8138 8137->7923 8139 9d6a43 SHQueryValueExW 8138->8139 8139->8137 8141 9d73f7 IsProcessorFeaturePresent 8140->8141 8142 9d73f6 8140->8142 8144 9d7acb 8141->8144 8142->7913 8147 9d7a8e SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 8144->8147 8146 9d7bae 8146->7913 8147->8146 8149 9dbe5d 8148->8149 8150 9dbe6f 8148->8150 8151 9d7d04 CallUnexpected GetModuleHandleW 8149->8151 8160 9dbcd9 8150->8160 8153 9dbe62 8151->8153 8153->8150 8175 9dbf1a GetModuleHandleExW 8153->8175 8155 9d7a78 8155->7539 8159 9dbec1 8161 9dbce5 CallCatchBlock 8160->8161 8181 9dd642 EnterCriticalSection 8161->8181 8163 9dbcef 8182 9dbd45 8163->8182 8165 9dbcfc 8186 9dbd1a 8165->8186 8168 9dbec7 8211 9dbef8 8168->8211 8171 9dbee5 8173 9dbf1a CallUnexpected 3 API calls 8171->8173 8172 9dbed5 GetCurrentProcess TerminateProcess 8172->8171 8174 9dbeed ExitProcess 8173->8174 8176 9dbf59 GetProcAddress 8175->8176 8177 9dbf7a 8175->8177 8176->8177 8178 9dbf6d 8176->8178 8179 9dbe6e 8177->8179 8180 9dbf80 FreeLibrary 8177->8180 8178->8177 8179->8150 8180->8179 8181->8163 8183 9dbd51 CallCatchBlock 8182->8183 8185 9dbdb8 CallUnexpected 8183->8185 8189 9dc823 8183->8189 8185->8165 8210 9dd68a LeaveCriticalSection 8186->8210 8188 9dbd08 8188->8155 8188->8168 8190 9dc82f __EH_prolog3 8189->8190 8193 9dc57b 8190->8193 8192 9dc856 CallUnexpected 8192->8185 8194 9dc587 CallCatchBlock 8193->8194 8201 9dd642 EnterCriticalSection 8194->8201 8196 9dc595 8202 9dc733 8196->8202 8201->8196 8203 9dc5a2 8202->8203 8204 9dc752 8202->8204 8206 9dc5ca 8203->8206 8204->8203 8205 9dd52b __freea 14 API calls 8204->8205 8205->8203 8209 9dd68a LeaveCriticalSection 8206->8209 8208 9dc5b3 8208->8192 8209->8208 8210->8188 8216 9dd6a1 GetPEB 8211->8216 8214 9dbed1 8214->8171 8214->8172 8215 9dbf02 GetPEB 8215->8214 8217 9dd6bb 8216->8217 8218 9dbefd 8216->8218 8220 9de844 8217->8220 8218->8214 8218->8215 8221 9de7c1 _unexpected 5 API calls 8220->8221 8222 9de860 8221->8222 8222->8218 8224 9dd256 8223->8224 8228 9dd25c 8223->8228 8226 9de902 _unexpected 6 API calls 8224->8226 8225 9de941 _unexpected 6 API calls 8227 9dd278 8225->8227 8226->8228 8230 9dd6d2 _unexpected 14 API calls 8227->8230 8247 9dd260 SetLastError 8227->8247 8228->8225 8228->8247 8231 9dd28d 8230->8231 8234 9dd295 8231->8234 8235 9dd2a6 8231->8235 8232 9dd2f5 8236 9dcd36 CallUnexpected 39 API calls 8232->8236 8233 9dccac 8233->7521 8237 9de941 _unexpected 6 API calls 8234->8237 8238 9de941 _unexpected 6 API calls 8235->8238 8239 9dd2fa 8236->8239 8240 9dd2a3 8237->8240 8241 9dd2b2 8238->8241 8244 9dd52b __freea 14 API calls 8240->8244 8242 9dd2cd 8241->8242 8243 9dd2b6 8241->8243 8245 9dd06e _unexpected 14 API calls 8242->8245 8246 9de941 _unexpected 6 API calls 8243->8246 8244->8247 8248 9dd2d8 8245->8248 8246->8240 8247->8232 8247->8233 8249 9dd52b __freea 14 API calls 8248->8249 8249->8247 8251 9dc9d5 8250->8251 8253 9dc9e7 ___scrt_uninitialize_crt 8250->8253 8252 9dc9e3 8251->8252 8255 9df395 8251->8255 8252->7533 8253->7533 8258 9df222 8255->8258 8261 9df176 8258->8261 8262 9df182 CallCatchBlock 8261->8262 8269 9dd642 EnterCriticalSection 8262->8269 8264 9df1f8 8278 9df216 8264->8278 8265 9df18c ___scrt_uninitialize_crt 8265->8264 8270 9df0ea 8265->8270 8269->8265 8271 9df0f6 CallCatchBlock 8270->8271 8281 9df4b2 EnterCriticalSection 8271->8281 8273 9df14c 8295 9df16a 8273->8295 8274 9df100 ___scrt_uninitialize_crt 8274->8273 8282 9df330 8274->8282 8397 9dd68a LeaveCriticalSection 8278->8397 8280 9df204 8280->8252 8281->8274 8283 9df345 ___std_exception_copy 8282->8283 8284 9df34c 8283->8284 8285 9df357 8283->8285 8287 9df222 ___scrt_uninitialize_crt 70 API calls 8284->8287 8298 9df2c7 8285->8298 8289 9df352 8287->8289 8290 9db776 ___std_exception_copy 41 API calls 8289->8290 8292 9df38f 8290->8292 8292->8273 8293 9df378 8311 9e0f24 8293->8311 8396 9df4c6 LeaveCriticalSection 8295->8396 8297 9df158 8297->8265 8299 9df307 8298->8299 8300 9df2e0 8298->8300 8299->8289 8304 9e065c 8299->8304 8300->8299 8301 9e065c ___scrt_uninitialize_crt 41 API calls 8300->8301 8302 9df2fc 8301->8302 8322 9e174f 8302->8322 8305 9e067d 8304->8305 8306 9e0668 8304->8306 8305->8293 8307 9dbaf8 __freea 14 API calls 8306->8307 8308 9e066d 8307->8308 8309 9dba3a ___std_exception_copy 41 API calls 8308->8309 8310 9e0678 8309->8310 8310->8293 8312 9e0f35 8311->8312 8313 9e0f42 8311->8313 8314 9dbaf8 __freea 14 API calls 8312->8314 8315 9e0f8b 8313->8315 8317 9e0f69 8313->8317 8319 9e0f3a 8314->8319 8316 9dbaf8 __freea 14 API calls 8315->8316 8318 9e0f90 8316->8318 8363 9e0e82 8317->8363 8321 9dba3a ___std_exception_copy 41 API calls 8318->8321 8319->8289 8321->8319 8324 9e175b CallCatchBlock 8322->8324 8323 9e181f 8325 9db9bd ___std_exception_copy 41 API calls 8323->8325 8324->8323 8326 9e1763 8324->8326 8327 9e17b0 8324->8327 8325->8326 8326->8299 8333 9df701 EnterCriticalSection 8327->8333 8329 9e17b6 8330 9e17d3 8329->8330 8334 9e1857 8329->8334 8360 9e1817 8330->8360 8333->8329 8335 9e187c 8334->8335 8358 9e189f ___scrt_uninitialize_crt 8334->8358 8336 9e1880 8335->8336 8338 9e18de 8335->8338 8337 9db9bd ___std_exception_copy 41 API calls 8336->8337 8337->8358 8339 9e18f5 8338->8339 8340 9e1f2e ___scrt_uninitialize_crt 43 API calls 8338->8340 8341 9e13db ___scrt_uninitialize_crt 42 API calls 8339->8341 8340->8339 8342 9e18ff 8341->8342 8343 9e1945 8342->8343 8344 9e1905 8342->8344 8345 9e19a8 WriteFile 8343->8345 8346 9e1959 8343->8346 8347 9e192f 8344->8347 8348 9e190c 8344->8348 8351 9e19ca GetLastError 8345->8351 8345->8358 8349 9e1996 8346->8349 8350 9e1961 8346->8350 8352 9e0fa1 ___scrt_uninitialize_crt 47 API calls 8347->8352 8355 9e1373 ___scrt_uninitialize_crt 6 API calls 8348->8355 8348->8358 8356 9e1459 ___scrt_uninitialize_crt 7 API calls 8349->8356 8353 9e1966 8350->8353 8354 9e1984 8350->8354 8351->8358 8352->8358 8353->8358 8359 9e1534 ___scrt_uninitialize_crt 7 API calls 8353->8359 8357 9e161d ___scrt_uninitialize_crt 8 API calls 8354->8357 8355->8358 8356->8358 8357->8358 8358->8330 8359->8358 8361 9df724 ___scrt_uninitialize_crt LeaveCriticalSection 8360->8361 8362 9e181d 8361->8362 8362->8326 8364 9e0e8e CallCatchBlock 8363->8364 8376 9df701 EnterCriticalSection 8364->8376 8366 9e0e9d 8367 9e0ee2 8366->8367 8377 9df7d8 8366->8377 8369 9dbaf8 __freea 14 API calls 8367->8369 8371 9e0ee9 8369->8371 8370 9e0ec9 FlushFileBuffers 8370->8371 8372 9e0ed5 GetLastError 8370->8372 8393 9e0f18 8371->8393 8390 9dbae5 8372->8390 8376->8366 8378 9df7e5 8377->8378 8379 9df7fa 8377->8379 8380 9dbae5 ___scrt_uninitialize_crt 14 API calls 8378->8380 8381 9dbae5 ___scrt_uninitialize_crt 14 API calls 8379->8381 8383 9df81f 8379->8383 8382 9df7ea 8380->8382 8384 9df82a 8381->8384 8385 9dbaf8 __freea 14 API calls 8382->8385 8383->8370 8386 9dbaf8 __freea 14 API calls 8384->8386 8387 9df7f2 8385->8387 8388 9df832 8386->8388 8387->8370 8389 9dba3a ___std_exception_copy 41 API calls 8388->8389 8389->8387 8391 9dd391 __freea 14 API calls 8390->8391 8392 9dbaea 8391->8392 8392->8367 8394 9df724 ___scrt_uninitialize_crt LeaveCriticalSection 8393->8394 8395 9e0f01 8394->8395 8395->8319 8396->8297 8397->8280 9458 9e3507 9459 9e3520 __startOneArgErrorHandling 9458->9459 9460 9e3549 __startOneArgErrorHandling 9459->9460 9461 9e38a1 20 API calls 9459->9461 9461->9460 8507 9dec87 8508 9dec8c 8507->8508 8509 9decaf 8508->8509 8511 9df62e 8508->8511 8512 9df63b 8511->8512 8513 9df65d 8511->8513 8514 9df649 DeleteCriticalSection 8512->8514 8515 9df657 8512->8515 8513->8508 8514->8514 8514->8515 8516 9dd52b __freea 14 API calls 8515->8516 8516->8513 9462 9dd107 9463 9dd112 9462->9463 9467 9dd122 9462->9467 9468 9dd128 9463->9468 9466 9dd52b __freea 14 API calls 9466->9467 9469 9dd13d 9468->9469 9470 9dd143 9468->9470 9471 9dd52b __freea 14 API calls 9469->9471 9472 9dd52b __freea 14 API calls 9470->9472 9471->9470 9473 9dd14f 9472->9473 9474 9dd52b __freea 14 API calls 9473->9474 9475 9dd15a 9474->9475 9476 9dd52b __freea 14 API calls 9475->9476 9477 9dd165 9476->9477 9478 9dd52b __freea 14 API calls 9477->9478 9479 9dd170 9478->9479 9480 9dd52b __freea 14 API calls 9479->9480 9481 9dd17b 9480->9481 9482 9dd52b __freea 14 API calls 9481->9482 9483 9dd186 9482->9483 9484 9dd52b __freea 14 API calls 9483->9484 9485 9dd191 9484->9485 9486 9dd52b __freea 14 API calls 9485->9486 9487 9dd19c 9486->9487 9488 9dd52b __freea 14 API calls 9487->9488 9489 9dd1aa 9488->9489 9494 9dcf54 9489->9494 9495 9dcf60 CallCatchBlock 9494->9495 9510 9dd642 EnterCriticalSection 9495->9510 9497 9dcf94 9511 9dcfb3 9497->9511 9500 9dcf6a 9500->9497 9501 9dd52b __freea 14 API calls 9500->9501 9501->9497 9502 9dcfbf 9503 9dcfcb CallCatchBlock 9502->9503 9515 9dd642 EnterCriticalSection 9503->9515 9505 9dcfd5 9506 9dd1f5 _unexpected 14 API calls 9505->9506 9507 9dcfe8 9506->9507 9516 9dd008 9507->9516 9510->9500 9514 9dd68a LeaveCriticalSection 9511->9514 9513 9dcfa1 9513->9502 9514->9513 9515->9505 9519 9dd68a LeaveCriticalSection 9516->9519 9518 9dcff6 9518->9466 9519->9518 9520 9e3205 9521 9e322d 9520->9521 9522 9e3265 9521->9522 9523 9e325e 9521->9523 9524 9e3257 9521->9524 9529 9e32c0 9523->9529 9526 9e32d7 20 API calls 9524->9526 9528 9e325c 9526->9528 9530 9e32e0 9529->9530 9531 9e374f __startOneArgErrorHandling 20 API calls 9530->9531 9532 9e3263 9531->9532 8517 9d7a81 8520 9d8032 8517->8520 8519 9d7a86 8519->8519 8521 9d8048 8520->8521 8523 9d8051 8521->8523 8524 9d7fe5 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 8521->8524 8523->8519 8524->8523 9533 9dd601 9534 9dd60c 9533->9534 9535 9de983 6 API calls 9534->9535 9536 9dd635 9534->9536 9538 9dd631 9534->9538 9535->9534 9539 9dd659 9536->9539 9540 9dd685 9539->9540 9541 9dd666 9539->9541 9540->9538 9542 9dd670 DeleteCriticalSection 9541->9542 9542->9540 9542->9542 8525 9db083 8528 9d9a5f 8525->8528 8529 9d9a71 8528->8529 8530 9d9a83 8528->8530 8529->8530 8531 9d9a79 8529->8531 8532 9d9b24 CallUnexpected 51 API calls 8530->8532 8534 9d9b24 CallUnexpected 51 API calls 8531->8534 8537 9d9a81 8531->8537 8533 9d9a88 8532->8533 8535 9d9b24 CallUnexpected 51 API calls 8533->8535 8533->8537 8536 9d9aa1 8534->8536 8535->8537 8538 9d9b24 CallUnexpected 51 API calls 8536->8538 8539 9d9aac 8538->8539 8542 9dcc9b 8539->8542 8543 9dcca7 CallCatchBlock 8542->8543 8544 9dd240 _unexpected 41 API calls 8543->8544 8545 9dccac 8544->8545 8546 9dcd36 CallUnexpected 41 API calls 8545->8546 8547 9dccd6 8546->8547 8548 9dc8bd 8549 9dd52b __freea 14 API calls 8548->8549 8550 9dc8cb 8549->8550 8551 9dd52b __freea 14 API calls 8550->8551 8552 9dc8de 8551->8552 8553 9dd52b __freea 14 API calls 8552->8553 8554 9dc8ef 8553->8554 8555 9dd52b __freea 14 API calls 8554->8555 8556 9dc900 8555->8556 9546 9dad3f 9549 9db2b7 9546->9549 9550 9dad4e 9549->9550 9551 9db2c4 9549->9551 9552 9dbb0b ___std_exception_copy 14 API calls 9551->9552 9552->9550 8557 9deab8 GetStartupInfoW 8558 9deade 8557->8558 8559 9deb72 8557->8559 8558->8559 8560 9df663 42 API calls 8558->8560 8561 9deb06 8560->8561 8561->8559 8562 9deb36 GetFileType 8561->8562 8562->8561 9553 9e453b 9554 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 9553->9554 9555 9e454f 9554->9555 9556 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 9555->9556 9557 9e4559 9556->9557 9558 9da53a 9559 9da551 9558->9559 9560 9dcd36 CallUnexpected 41 API calls 9559->9560 9561 9da556 CallCatchBlock 9560->9561 9562 9da419 __InternalCxxFrameHandler 41 API calls 9561->9562 9563 9da58b __InternalCxxFrameHandler ___AdjustPointer 9562->9563 9564 9d7a3a 9565 9d7d04 CallUnexpected GetModuleHandleW 9564->9565 9566 9d7a42 9565->9566 9567 9d7a78 9566->9567 9568 9d7a46 9566->9568 9570 9dbfc9 CallUnexpected 23 API calls 9567->9570 9569 9d7a51 9568->9569 9573 9dbfab 9568->9573 9572 9d7a80 9570->9572 9574 9dbe30 CallUnexpected 23 API calls 9573->9574 9575 9dbfb6 9574->9575 9575->9569 9576 9dc934 9579 9dc525 9576->9579 9578 9dc939 9580 9dc531 __EH_prolog3 9579->9580 9589 9dc4ef 9580->9589 9587 9dc4c0 14 API calls 9588 9dc568 CallUnexpected 9587->9588 9588->9578 9590 9dc507 9589->9590 9591 9dc501 9589->9591 9593 9dc50a 9590->9593 9592 9dc4c0 14 API calls 9591->9592 9592->9590 9594 9dc51c 9593->9594 9595 9dc522 9593->9595 9596 9dc4c0 14 API calls 9594->9596 9597 9dc4c0 9595->9597 9596->9595 9601 9dc4cd 9597->9601 9602 9dc4ea 9597->9602 9598 9dc4e4 9600 9dd52b __freea 14 API calls 9598->9600 9599 9dd52b __freea 14 API calls 9599->9601 9600->9602 9601->9598 9601->9599 9602->9587 8563 9d97b0 8564 9d97ce CallCatchBlock 8563->8564 8575 9d9770 8564->8575 8576 9d978f 8575->8576 8577 9d9782 8575->8577 8578 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 8577->8578 8578->8576 8579 9dd9b3 8580 9dd9de 8579->8580 8581 9dda2c FindFirstFileExW 8580->8581 8582 9dda0d 8580->8582 8581->8582 8583 9dda63 8581->8583 8584 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 8582->8584 8585 9ddac1 FindNextFileW 8583->8585 8587 9ddb0d FindClose 8583->8587 8586 9ddb27 8584->8586 8585->8583 8589 9ddad6 8585->8589 8587->8582 8588 9ddaea FindClose 8588->8582 8589->8588 8592 9e0690 8589->8592 8593 9e06ca 8592->8593 8594 9dbaf8 __freea 14 API calls 8593->8594 8599 9e06de 8593->8599 8595 9e06d3 8594->8595 8597 9dba3a ___std_exception_copy 41 API calls 8595->8597 8596 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 8598 9ddb08 8596->8598 8597->8599 8598->8588 8599->8596 9603 9e2a30 9606 9e2a4e 9603->9606 9605 9e2a46 9610 9e2a53 9606->9610 9607 9e3313 15 API calls 9609 9e2c7f 9607->9609 9608 9e2ae8 9608->9605 9609->9605 9610->9607 9610->9608 8600 9d65b2 HeapAlloc 9611 9dae32 9612 9d9b24 CallUnexpected 51 API calls 9611->9612 9613 9dae3a __FrameHandler3::FrameUnwindToState 9612->9613 9614 9db001 __FrameHandler3::FrameUnwindToState 51 API calls 9613->9614 9615 9daeab 9614->9615 9616 9daee4 CallCatchBlock 54 API calls 9615->9616 9617 9daecc 9616->9617 9618 9d662d 9621 9d6596 9618->9621 9620 9d6638 _AnonymousOriginator 9622 9d65b1 9621->9622 9623 9d65a2 9621->9623 9622->9620 9623->9622 9624 9d65a8 HeapDestroy 9623->9624 9624->9622 9625 9e212f 9627 9e2138 9625->9627 9626 9e21a0 9629 9e32d7 20 API calls 9626->9629 9630 9e31ce 9626->9630 9627->9626 9628 9e215f 9627->9628 9628->9630 9632 9e32d7 20 API calls 9628->9632 9631 9e21ee 9629->9631 9633 9e31fe 9632->9633 8601 9e44aa 8602 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 8601->8602 8603 9e44bb 8602->8603 8604 9da2a9 8605 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 8604->8605 8606 9da2bb 8605->8606 8609 9dabde 8606->8609 8610 9dabec ___except_validate_context_record 8609->8610 8611 9d9b24 CallUnexpected 51 API calls 8610->8611 8612 9dabf2 8611->8612 8613 9dac31 8612->8613 8614 9dac57 8612->8614 8617 9da2d4 8612->8617 8613->8617 8618 9dafe9 8613->8618 8614->8617 8621 9da670 8614->8621 8671 9db001 8618->8671 8620 9daffc 8620->8617 8626 9da690 __FrameHandler3::FrameUnwindToState 8621->8626 8622 9da9a8 8623 9dcd36 CallUnexpected 41 API calls 8622->8623 8634 9da9ae 8622->8634 8624 9daa19 8623->8624 8625 9da97d 8625->8622 8627 9da97b 8625->8627 8700 9daa1a 8625->8700 8626->8622 8628 9da772 8626->8628 8629 9d9b24 CallUnexpected 51 API calls 8626->8629 8631 9d9b24 CallUnexpected 51 API calls 8627->8631 8628->8625 8630 9da7fb 8628->8630 8670 9da778 type_info::operator== 8628->8670 8633 9da6f2 8629->8633 8638 9da913 __InternalCxxFrameHandler 8630->8638 8685 9da063 8630->8685 8631->8622 8633->8634 8636 9d9b24 CallUnexpected 51 API calls 8633->8636 8634->8617 8639 9da700 8636->8639 8637 9da81c ___TypeMatch 8637->8638 8690 9da5f0 8637->8690 8638->8627 8640 9da96c 8638->8640 8641 9da957 8638->8641 8642 9d9b24 CallUnexpected 51 API calls 8639->8642 8644 9db0e9 IsInExceptionSpec 41 API calls 8640->8644 8643 9d9b24 CallUnexpected 51 API calls 8641->8643 8651 9da708 8642->8651 8645 9da95c 8643->8645 8646 9da975 8644->8646 8647 9d9b24 CallUnexpected 51 API calls 8645->8647 8646->8627 8648 9da9d8 8646->8648 8647->8670 8650 9d9b24 CallUnexpected 51 API calls 8648->8650 8649 9d9b24 CallUnexpected 51 API calls 8652 9da751 8649->8652 8653 9da9dd 8650->8653 8651->8622 8651->8649 8652->8628 8656 9d9b24 CallUnexpected 51 API calls 8652->8656 8654 9d9b24 CallUnexpected 51 API calls 8653->8654 8657 9da9e5 8654->8657 8655 9dcc9b _unexpected 41 API calls 8664 9da9b8 __InternalCxxFrameHandler 8655->8664 8658 9da75b 8656->8658 8720 9da256 RtlUnwind 8657->8720 8659 9d9b24 CallUnexpected 51 API calls 8658->8659 8662 9da766 8659->8662 8680 9db0e9 8662->8680 8663 9da9f9 8666 9dafe9 __InternalCxxFrameHandler 51 API calls 8663->8666 8717 9db2d6 8664->8717 8668 9daa05 __InternalCxxFrameHandler 8666->8668 8721 9daf60 8668->8721 8670->8655 8670->8664 8672 9db00d __FrameHandler3::FrameUnwindToState CallCatchBlock 8671->8672 8673 9d9b24 CallUnexpected 51 API calls 8672->8673 8674 9db028 __CallSettingFrame@12 __FrameHandler3::FrameUnwindToState 8673->8674 8675 9db0a8 8674->8675 8676 9db0cf __FrameHandler3::FrameUnwindToState 51 API calls 8674->8676 8677 9dcd36 CallUnexpected 41 API calls 8675->8677 8679 9db0ad __FrameHandler3::FrameUnwindToState 8675->8679 8676->8675 8678 9db0e8 8677->8678 8679->8620 8681 9db17d 8680->8681 8684 9db0fd ___TypeMatch 8680->8684 8682 9dcd36 CallUnexpected 41 API calls 8681->8682 8683 9db182 8682->8683 8684->8628 8686 9da081 8685->8686 8687 9da0b7 8686->8687 8688 9dcd36 CallUnexpected 41 API calls 8686->8688 8687->8637 8689 9da0d2 8688->8689 8691 9da60f 8690->8691 8692 9da602 8690->8692 8737 9da256 RtlUnwind 8691->8737 8733 9da557 8692->8733 8695 9da624 8696 9db001 __FrameHandler3::FrameUnwindToState 51 API calls 8695->8696 8697 9da635 __FrameHandler3::FrameUnwindToState 8696->8697 8738 9dad9c 8697->8738 8699 9da65d __InternalCxxFrameHandler 8699->8637 8701 9daa30 8700->8701 8712 9dab45 8700->8712 8702 9d9b24 CallUnexpected 51 API calls 8701->8702 8703 9daa37 8702->8703 8704 9daa3e EncodePointer 8703->8704 8714 9daa79 8703->8714 8705 9d9b24 CallUnexpected 51 API calls 8704->8705 8710 9daa4c 8705->8710 8706 9dab4a 8708 9dcd36 CallUnexpected 41 API calls 8706->8708 8707 9daa96 8709 9da063 __InternalCxxFrameHandler 41 API calls 8707->8709 8711 9dab4f 8708->8711 8715 9daaad 8709->8715 8713 9da130 CallCatchBlock 51 API calls 8710->8713 8710->8714 8712->8627 8713->8714 8714->8706 8714->8707 8714->8712 8715->8712 8716 9da5f0 __InternalCxxFrameHandler 53 API calls 8715->8716 8716->8715 8718 9db31d RaiseException 8717->8718 8719 9db2f0 8717->8719 8718->8648 8719->8718 8720->8663 8722 9daf6c __EH_prolog3_catch 8721->8722 8723 9d9b24 CallUnexpected 51 API calls 8722->8723 8724 9daf71 8723->8724 8725 9daf94 8724->8725 8800 9db20c 8724->8800 8726 9dcd36 CallUnexpected 41 API calls 8725->8726 8729 9daf99 8726->8729 8734 9da563 CallCatchBlock 8733->8734 8752 9da419 8734->8752 8736 9da58b __InternalCxxFrameHandler ___AdjustPointer 8736->8691 8737->8695 8739 9dada8 CallCatchBlock 8738->8739 8759 9da2da 8739->8759 8742 9d9b24 CallUnexpected 51 API calls 8743 9dadd4 8742->8743 8744 9d9b24 CallUnexpected 51 API calls 8743->8744 8745 9daddf 8744->8745 8746 9d9b24 CallUnexpected 51 API calls 8745->8746 8747 9dadea 8746->8747 8748 9d9b24 CallUnexpected 51 API calls 8747->8748 8749 9dadf2 CallCatchBlock 8748->8749 8764 9daee4 8749->8764 8751 9daecc 8751->8699 8753 9da425 CallCatchBlock 8752->8753 8754 9dcd36 CallUnexpected 41 API calls 8753->8754 8755 9da4a0 __InternalCxxFrameHandler ___AdjustPointer 8753->8755 8756 9da556 CallCatchBlock 8754->8756 8755->8736 8757 9da419 __InternalCxxFrameHandler 41 API calls 8756->8757 8758 9da58b __InternalCxxFrameHandler ___AdjustPointer 8757->8758 8758->8736 8760 9d9b24 CallUnexpected 51 API calls 8759->8760 8761 9da2eb 8760->8761 8762 9d9b24 CallUnexpected 51 API calls 8761->8762 8763 9da2f6 8762->8763 8763->8742 8773 9da2fe 8764->8773 8766 9daef5 8767 9d9b24 CallUnexpected 51 API calls 8766->8767 8768 9daefb 8767->8768 8769 9d9b24 CallUnexpected 51 API calls 8768->8769 8771 9daf06 8769->8771 8770 9daf47 __InternalCxxFrameHandler 8770->8751 8771->8770 8792 9d9a14 8771->8792 8774 9d9b24 CallUnexpected 51 API calls 8773->8774 8775 9da307 8774->8775 8776 9da31d 8775->8776 8777 9da30f 8775->8777 8779 9d9b24 CallUnexpected 51 API calls 8776->8779 8778 9d9b24 CallUnexpected 51 API calls 8777->8778 8783 9da317 8778->8783 8780 9da322 8779->8780 8781 9dcd36 CallUnexpected 41 API calls 8780->8781 8780->8783 8782 9da345 8781->8782 8784 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 8782->8784 8783->8766 8785 9da35a 8784->8785 8786 9da365 8785->8786 8787 9dabde __InternalCxxFrameHandler 54 API calls 8785->8787 8786->8766 8788 9da39d 8787->8788 8789 9da3b4 8788->8789 8795 9da256 RtlUnwind 8788->8795 8796 9da130 8789->8796 8793 9d9b24 CallUnexpected 51 API calls 8792->8793 8794 9d9a1c 8793->8794 8794->8770 8795->8789 8797 9da152 CallCatchBlock 8796->8797 8799 9da140 8796->8799 8798 9d9b24 CallUnexpected 51 API calls 8797->8798 8798->8799 8799->8786 8801 9d9b24 CallUnexpected 51 API calls 8800->8801 8804 9db212 8801->8804 8802 9dcc9b _unexpected 41 API calls 8803 9db228 8802->8803 8804->8802 8805 9df5a8 8807 9df4da 8805->8807 8806 9df4f4 8808 9df508 8806->8808 8809 9dbaf8 __freea 14 API calls 8806->8809 8807->8806 8807->8808 8812 9df532 8807->8812 8810 9df4fe 8809->8810 8811 9dba3a ___std_exception_copy 41 API calls 8810->8811 8811->8808 8812->8808 8813 9dbaf8 __freea 14 API calls 8812->8813 8813->8810 9634 9dae28 9637 9daf9f 9634->9637 9636 9dae30 9638 9dafe5 9637->9638 9639 9dafaf 9637->9639 9638->9636 9639->9638 9640 9d9b24 CallUnexpected 51 API calls 9639->9640 9641 9dafdb 9640->9641 9641->9636 8814 9ddbab 8815 9ddbb8 8814->8815 8816 9ddbc8 8814->8816 8815->8816 8818 9dd52b __freea 14 API calls 8815->8818 8817 9dd52b __freea 14 API calls 8816->8817 8819 9ddbd0 8817->8819 8818->8815 9642 9e0929 9645 9e06de 9642->9645 9643 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 9644 9e06eb 9643->9644 9645->9643 8824 9dd9a6 8825 9dba4a ___std_exception_copy 11 API calls 8824->8825 8826 9dd9b2 8825->8826 8827 9dda2c FindFirstFileExW 8826->8827 8828 9dda0d 8826->8828 8827->8828 8829 9dda63 8827->8829 8830 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 8828->8830 8831 9ddac1 FindNextFileW 8829->8831 8834 9ddb0d FindClose 8829->8834 8833 9ddb27 8830->8833 8831->8829 8832 9ddad6 8831->8832 8835 9ddaea FindClose 8832->8835 8836 9e0690 41 API calls 8832->8836 8834->8828 8835->8828 8837 9ddb08 8836->8837 8837->8835 8838 9deaa6 GetProcessHeap 9649 9d7a26 9652 9dbb93 9649->9652 9653 9dd391 __freea 14 API calls 9652->9653 9654 9d7a37 9653->9654 9655 9d9d20 9656 9d9d32 9655->9656 9658 9d9d40 9655->9658 9657 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 9656->9657 9657->9658 8839 9d72d6 8840 9d72de 8839->8840 8846 9d6511 InitializeCriticalSectionAndSpinCount 8840->8846 8843 9d7309 IsDebuggerPresent 8844 9d731e 8843->8844 8845 9d7313 OutputDebugStringW 8843->8845 8845->8844 8847 9d652c 8846->8847 8848 9d6520 GetLastError 8846->8848 8847->8843 8847->8844 8848->8847 8849 9dcbd6 8852 9dcb5d 8849->8852 8853 9dcb69 CallCatchBlock 8852->8853 8860 9dd642 EnterCriticalSection 8853->8860 8855 9dcb73 8856 9dcba1 8855->8856 8861 9dffd7 8855->8861 8865 9dcbbf 8856->8865 8860->8855 8862 9dfff2 8861->8862 8863 9dffe5 _unexpected 8861->8863 8862->8855 8863->8862 8868 9dfd0a 8863->8868 8982 9dd68a LeaveCriticalSection 8865->8982 8867 9dcbad 8870 9dfd8a 8868->8870 8871 9dfd20 8868->8871 8873 9dd52b __freea 14 API calls 8870->8873 8895 9dfdd8 8870->8895 8871->8870 8877 9dd52b __freea 14 API calls 8871->8877 8878 9dfd53 8871->8878 8872 9dfde6 8881 9dfe46 8872->8881 8892 9dd52b 14 API calls __freea 8872->8892 8874 9dfdac 8873->8874 8875 9dd52b __freea 14 API calls 8874->8875 8879 9dfdbf 8875->8879 8876 9dd52b __freea 14 API calls 8880 9dfd7f 8876->8880 8882 9dfd48 8877->8882 8883 9dd52b __freea 14 API calls 8878->8883 8894 9dfd75 8878->8894 8884 9dd52b __freea 14 API calls 8879->8884 8887 9dd52b __freea 14 API calls 8880->8887 8888 9dd52b __freea 14 API calls 8881->8888 8896 9df858 8882->8896 8885 9dfd6a 8883->8885 8886 9dfdcd 8884->8886 8924 9df956 8885->8924 8891 9dd52b __freea 14 API calls 8886->8891 8887->8870 8893 9dfe4c 8888->8893 8891->8895 8892->8872 8893->8862 8894->8876 8936 9dfe7b 8895->8936 8897 9df869 8896->8897 8923 9df952 8896->8923 8898 9df87a 8897->8898 8900 9dd52b __freea 14 API calls 8897->8900 8899 9df88c 8898->8899 8901 9dd52b __freea 14 API calls 8898->8901 8902 9df89e 8899->8902 8903 9dd52b __freea 14 API calls 8899->8903 8900->8898 8901->8899 8904 9df8b0 8902->8904 8905 9dd52b __freea 14 API calls 8902->8905 8903->8902 8906 9df8c2 8904->8906 8908 9dd52b __freea 14 API calls 8904->8908 8905->8904 8907 9df8d4 8906->8907 8909 9dd52b __freea 14 API calls 8906->8909 8910 9df8e6 8907->8910 8911 9dd52b __freea 14 API calls 8907->8911 8908->8906 8909->8907 8912 9dd52b __freea 14 API calls 8910->8912 8914 9df8f8 8910->8914 8911->8910 8912->8914 8913 9df90a 8915 9df91c 8913->8915 8917 9dd52b __freea 14 API calls 8913->8917 8914->8913 8916 9dd52b __freea 14 API calls 8914->8916 8918 9df92e 8915->8918 8919 9dd52b __freea 14 API calls 8915->8919 8916->8913 8917->8915 8920 9df940 8918->8920 8921 9dd52b __freea 14 API calls 8918->8921 8919->8918 8922 9dd52b __freea 14 API calls 8920->8922 8920->8923 8921->8920 8922->8923 8923->8878 8925 9df963 8924->8925 8935 9df9bb 8924->8935 8926 9df973 8925->8926 8927 9dd52b __freea 14 API calls 8925->8927 8928 9df985 8926->8928 8929 9dd52b __freea 14 API calls 8926->8929 8927->8926 8930 9dd52b __freea 14 API calls 8928->8930 8932 9df997 8928->8932 8929->8928 8930->8932 8931 9df9a9 8934 9dd52b __freea 14 API calls 8931->8934 8931->8935 8932->8931 8933 9dd52b __freea 14 API calls 8932->8933 8933->8931 8934->8935 8935->8894 8937 9dfea7 8936->8937 8938 9dfe88 8936->8938 8937->8872 8938->8937 8942 9df9e4 8938->8942 8941 9dd52b __freea 14 API calls 8941->8937 8943 9dfac2 8942->8943 8944 9df9f5 8942->8944 8943->8941 8978 9df9bf 8944->8978 8947 9df9bf _unexpected 14 API calls 8948 9dfa08 8947->8948 8949 9df9bf _unexpected 14 API calls 8948->8949 8950 9dfa13 8949->8950 8951 9df9bf _unexpected 14 API calls 8950->8951 8952 9dfa1e 8951->8952 8953 9df9bf _unexpected 14 API calls 8952->8953 8954 9dfa2c 8953->8954 8955 9dd52b __freea 14 API calls 8954->8955 8956 9dfa37 8955->8956 8957 9dd52b __freea 14 API calls 8956->8957 8958 9dfa42 8957->8958 8959 9dd52b __freea 14 API calls 8958->8959 8960 9dfa4d 8959->8960 8961 9df9bf _unexpected 14 API calls 8960->8961 8962 9dfa5b 8961->8962 8963 9df9bf _unexpected 14 API calls 8962->8963 8964 9dfa69 8963->8964 8965 9df9bf _unexpected 14 API calls 8964->8965 8966 9dfa7a 8965->8966 8967 9df9bf _unexpected 14 API calls 8966->8967 8968 9dfa88 8967->8968 8969 9df9bf _unexpected 14 API calls 8968->8969 8970 9dfa96 8969->8970 8971 9dd52b __freea 14 API calls 8970->8971 8972 9dfaa1 8971->8972 8973 9dd52b __freea 14 API calls 8972->8973 8974 9dfaac 8973->8974 8975 9dd52b __freea 14 API calls 8974->8975 8976 9dfab7 8975->8976 8977 9dd52b __freea 14 API calls 8976->8977 8977->8943 8979 9df9d1 8978->8979 8980 9df9e0 8979->8980 8981 9dd52b __freea 14 API calls 8979->8981 8980->8947 8981->8979 8982->8867 9659 9d7d53 9660 9d7d8a 9659->9660 9662 9d7d65 9659->9662 9662->9660 9668 9d9ab5 9662->9668 9666 9dcc9b _unexpected 41 API calls 9667 9d7da8 9666->9667 9669 9d9b24 CallUnexpected 51 API calls 9668->9669 9670 9d7d97 9669->9670 9671 9d9abe 9670->9671 9672 9d9b24 CallUnexpected 51 API calls 9671->9672 9673 9d7da1 9672->9673 9673->9666 9674 9d704d 9675 9d705e 9674->9675 9677 9d706f 9675->9677 9678 9d71bf 9675->9678 9680 9d71de 9678->9680 9679 9d7233 9680->9679 9681 9d70a4 14 API calls 9680->9681 9682 9d720a 9681->9682 9682->9677 9683 9d734c DeleteCriticalSection 9684 9d73cc 9683->9684 9685 9d73db 9684->9685 9686 9dbb0b ___std_exception_copy 14 API calls 9684->9686 9686->9685 9687 9dc34e 9700 9de674 GetEnvironmentStringsW 9687->9700 9689 9dc35f 9690 9dc365 9689->9690 9691 9dc371 9689->9691 9692 9dd52b __freea 14 API calls 9690->9692 9707 9dc3a2 9691->9707 9694 9dc36b 9692->9694 9696 9dd52b __freea 14 API calls 9697 9dc395 9696->9697 9698 9dd52b __freea 14 API calls 9697->9698 9699 9dc39b 9698->9699 9701 9de685 9700->9701 9702 9de683 9700->9702 9703 9dfac8 15 API calls 9701->9703 9702->9689 9704 9de69a __InternalCxxFrameHandler 9703->9704 9705 9dd52b __freea 14 API calls 9704->9705 9706 9de6b4 FreeEnvironmentStringsW 9705->9706 9706->9689 9709 9dc3c1 9707->9709 9708 9dd6d2 _unexpected 14 API calls 9710 9dc401 9708->9710 9709->9708 9711 9dc409 9710->9711 9717 9dc413 9710->9717 9712 9dd52b __freea 14 API calls 9711->9712 9714 9dc378 9712->9714 9713 9dc488 9715 9dd52b __freea 14 API calls 9713->9715 9714->9696 9715->9714 9716 9dd6d2 _unexpected 14 API calls 9716->9717 9717->9713 9717->9716 9718 9dc498 9717->9718 9719 9db6ca 41 API calls 9717->9719 9722 9dc4b3 9717->9722 9725 9dd52b __freea 14 API calls 9717->9725 9720 9dc4c0 14 API calls 9718->9720 9719->9717 9721 9dc49e 9720->9721 9723 9dd52b __freea 14 API calls 9721->9723 9726 9dba4a ___std_exception_copy 11 API calls 9722->9726 9724 9dc4a6 9723->9724 9727 9dd52b __freea 14 API calls 9724->9727 9725->9717 9728 9dc4bf 9726->9728 9727->9714 8986 9dccc7 8987 9dccca 8986->8987 8988 9dcd36 CallUnexpected 41 API calls 8987->8988 8989 9dccd6 8988->8989 8990 9d65c7 8991 9d65de 8990->8991 8992 9d65d0 HeapFree 8990->8992 8992->8991 9733 9d7840 9734 9d7848 9733->9734 9750 9dcb20 9734->9750 9736 9d7853 9737 9d7690 4 API calls 9736->9737 9739 9d7868 __RTC_Initialize 9737->9739 9738 9d7bb0 4 API calls 9740 9d78ea 9738->9740 9741 9d781d 44 API calls 9739->9741 9748 9d78c5 9739->9748 9742 9d7881 9741->9742 9742->9748 9757 9d8083 InitializeSListHead 9742->9757 9744 9d7897 9758 9d8092 9744->9758 9746 9d78ba 9764 9dcbfd 9746->9764 9748->9738 9749 9d78e2 9748->9749 9751 9dcb2f 9750->9751 9752 9dcb52 9750->9752 9751->9752 9753 9dbaf8 __freea 14 API calls 9751->9753 9752->9736 9754 9dcb42 9753->9754 9755 9dba3a ___std_exception_copy 41 API calls 9754->9755 9756 9dcb4d 9755->9756 9756->9736 9757->9744 9771 9dccd7 9758->9771 9760 9d80a3 9761 9d80aa 9760->9761 9762 9d7bb0 4 API calls 9760->9762 9761->9746 9763 9d80b2 9762->9763 9765 9dd240 _unexpected 41 API calls 9764->9765 9766 9dcc08 9765->9766 9767 9dcc40 9766->9767 9768 9dbaf8 __freea 14 API calls 9766->9768 9767->9748 9769 9dcc35 9768->9769 9770 9dba3a ___std_exception_copy 41 API calls 9769->9770 9770->9767 9772 9dccf5 9771->9772 9774 9dcd15 9771->9774 9773 9dbaf8 __freea 14 API calls 9772->9773 9775 9dcd0b 9773->9775 9774->9760 9776 9dba3a ___std_exception_copy 41 API calls 9775->9776 9776->9774 8993 9d73fc 9004 9d7423 InitializeCriticalSectionAndSpinCount GetModuleHandleW 8993->9004 8995 9d7401 9015 9d7690 8995->9015 8997 9d7408 8998 9d740d 8997->8998 8999 9d741b 8997->8999 9000 9d781d 44 API calls 8998->9000 9001 9d7bb0 4 API calls 8999->9001 9002 9d7417 9000->9002 9003 9d7422 9001->9003 9005 9d7457 GetProcAddress GetProcAddress 9004->9005 9006 9d7446 GetModuleHandleW 9004->9006 9007 9d7475 9005->9007 9008 9d7487 CreateEventW 9005->9008 9006->9005 9009 9d749d 9006->9009 9007->9008 9010 9d7479 9007->9010 9008->9009 9008->9010 9011 9d7bb0 4 API calls 9009->9011 9010->8995 9012 9d74a4 DeleteCriticalSection 9011->9012 9013 9d74b9 CloseHandle 9012->9013 9014 9d74c0 9012->9014 9013->9014 9014->8995 9016 9d769c 9015->9016 9017 9d76a0 9015->9017 9016->8997 9018 9d7bb0 4 API calls 9017->9018 9020 9d76ad ___scrt_release_startup_lock 9017->9020 9019 9d7716 9018->9019 9020->8997 9777 9dd975 9784 9ddbf8 9777->9784 9780 9dd98b 9782 9dd52b __freea 14 API calls 9780->9782 9781 9dd52b __freea 14 API calls 9781->9780 9783 9dd930 9782->9783 9785 9ddc0a 9784->9785 9793 9dd97f 9784->9793 9786 9ddc0f 9785->9786 9787 9ddc35 9785->9787 9788 9dd6d2 _unexpected 14 API calls 9786->9788 9789 9dbb26 44 API calls 9787->9789 9787->9793 9790 9ddc18 9788->9790 9791 9ddc55 9789->9791 9792 9dd52b __freea 14 API calls 9790->9792 9794 9dd52b __freea 14 API calls 9791->9794 9792->9793 9793->9780 9793->9781 9794->9793 9021 9e0df7 9024 9de20d 9021->9024 9025 9de216 9024->9025 9026 9de248 9024->9026 9030 9dd2fb 9025->9030 9031 9dd306 9030->9031 9034 9dd30c 9030->9034 9032 9de902 _unexpected 6 API calls 9031->9032 9032->9034 9033 9de941 _unexpected 6 API calls 9035 9dd326 9033->9035 9034->9033 9036 9dd312 9034->9036 9035->9036 9038 9dd6d2 _unexpected 14 API calls 9035->9038 9037 9dd317 9036->9037 9039 9dcd36 CallUnexpected 41 API calls 9036->9039 9055 9de018 9037->9055 9041 9dd336 9038->9041 9040 9dd390 9039->9040 9042 9dd33e 9041->9042 9043 9dd353 9041->9043 9045 9de941 _unexpected 6 API calls 9042->9045 9044 9de941 _unexpected 6 API calls 9043->9044 9046 9dd35f 9044->9046 9047 9dd34a 9045->9047 9048 9dd363 9046->9048 9049 9dd372 9046->9049 9050 9dd52b __freea 14 API calls 9047->9050 9051 9de941 _unexpected 6 API calls 9048->9051 9052 9dd06e _unexpected 14 API calls 9049->9052 9050->9036 9051->9047 9053 9dd37d 9052->9053 9054 9dd52b __freea 14 API calls 9053->9054 9054->9037 9078 9de16d 9055->9078 9061 9de06c 9062 9de074 9061->9062 9063 9de082 9061->9063 9064 9dd52b __freea 14 API calls 9062->9064 9103 9de268 9063->9103 9068 9de05b 9064->9068 9067 9de0ba 9069 9dbaf8 __freea 14 API calls 9067->9069 9068->9026 9070 9de0bf 9069->9070 9072 9dd52b __freea 14 API calls 9070->9072 9071 9de101 9074 9de14a 9071->9074 9114 9ddc8a 9071->9114 9072->9068 9073 9de0d5 9073->9071 9076 9dd52b __freea 14 API calls 9073->9076 9075 9dd52b __freea 14 API calls 9074->9075 9075->9068 9076->9071 9079 9de179 CallCatchBlock 9078->9079 9081 9de193 9079->9081 9122 9dd642 EnterCriticalSection 9079->9122 9082 9de042 9081->9082 9085 9dcd36 CallUnexpected 41 API calls 9081->9085 9089 9ddd98 9082->9089 9083 9de1cf 9123 9de1ec 9083->9123 9087 9de20c 9085->9087 9086 9de1a3 9086->9083 9088 9dd52b __freea 14 API calls 9086->9088 9088->9083 9127 9ddb29 9089->9127 9092 9dddb9 GetOEMCP 9095 9ddde2 9092->9095 9093 9dddcb 9094 9dddd0 GetACP 9093->9094 9093->9095 9094->9095 9095->9068 9096 9dfac8 9095->9096 9097 9dfb06 9096->9097 9102 9dfad6 _unexpected 9096->9102 9099 9dbaf8 __freea 14 API calls 9097->9099 9098 9dfaf1 HeapAlloc 9100 9dfb04 9098->9100 9098->9102 9099->9100 9100->9061 9101 9ded5b _unexpected 2 API calls 9101->9102 9102->9097 9102->9098 9102->9101 9104 9ddd98 43 API calls 9103->9104 9105 9de288 9104->9105 9107 9de2c5 IsValidCodePage 9105->9107 9108 9de301 CallUnexpected 9105->9108 9106 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 9109 9de0af 9106->9109 9107->9108 9110 9de2d7 9107->9110 9108->9106 9109->9067 9109->9073 9111 9de306 GetCPInfo 9110->9111 9112 9de2e0 CallUnexpected 9110->9112 9111->9108 9111->9112 9166 9dde6c 9112->9166 9115 9ddc96 CallCatchBlock 9114->9115 9250 9dd642 EnterCriticalSection 9115->9250 9117 9ddca0 9251 9ddcd7 9117->9251 9122->9086 9126 9dd68a LeaveCriticalSection 9123->9126 9125 9de1f3 9125->9081 9126->9125 9128 9ddb47 9127->9128 9129 9ddb40 9127->9129 9128->9129 9130 9dd240 _unexpected 41 API calls 9128->9130 9129->9092 9129->9093 9131 9ddb68 9130->9131 9135 9e046d 9131->9135 9136 9e0480 9135->9136 9138 9ddb7e 9135->9138 9136->9138 9143 9dff56 9136->9143 9139 9e04cb 9138->9139 9140 9e04de 9139->9140 9141 9e04f3 9139->9141 9140->9141 9161 9de255 9140->9161 9141->9129 9144 9dff62 CallCatchBlock 9143->9144 9145 9dd240 _unexpected 41 API calls 9144->9145 9146 9dff6b 9145->9146 9147 9dffb1 9146->9147 9156 9dd642 EnterCriticalSection 9146->9156 9147->9138 9149 9dff89 9150 9dffd7 ___scrt_uninitialize_crt 14 API calls 9149->9150 9151 9dff9a 9150->9151 9157 9dffb6 9151->9157 9154 9dcd36 CallUnexpected 41 API calls 9155 9dffd6 9154->9155 9156->9149 9160 9dd68a LeaveCriticalSection 9157->9160 9159 9dffad 9159->9147 9159->9154 9160->9159 9162 9dd240 _unexpected 41 API calls 9161->9162 9163 9de25a 9162->9163 9164 9de16d ___scrt_uninitialize_crt 41 API calls 9163->9164 9165 9de265 9164->9165 9165->9141 9167 9dde94 GetCPInfo 9166->9167 9169 9ddf5d 9166->9169 9168 9ddeac 9167->9168 9167->9169 9177 9dfb64 9168->9177 9171 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 9169->9171 9173 9de016 9171->9173 9173->9108 9176 9e0dae 45 API calls 9176->9169 9178 9ddb29 41 API calls 9177->9178 9179 9dfb84 9178->9179 9197 9de50a 9179->9197 9181 9dfc48 9184 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 9181->9184 9182 9dfc40 9200 9dfc6d 9182->9200 9183 9dfbb1 9183->9181 9183->9182 9186 9dfac8 15 API calls 9183->9186 9188 9dfbd6 CallUnexpected __alloca_probe_16 9183->9188 9187 9ddf14 9184->9187 9186->9188 9192 9e0dae 9187->9192 9188->9182 9189 9de50a ___scrt_uninitialize_crt MultiByteToWideChar 9188->9189 9190 9dfc21 9189->9190 9190->9182 9191 9dfc2c GetStringTypeW 9190->9191 9191->9182 9193 9ddb29 41 API calls 9192->9193 9194 9e0dc1 9193->9194 9204 9e0bc0 9194->9204 9199 9de51b MultiByteToWideChar 9197->9199 9199->9183 9201 9dfc79 9200->9201 9202 9dfc8a 9200->9202 9201->9202 9203 9dd52b __freea 14 API calls 9201->9203 9202->9181 9203->9202 9205 9e0bdb 9204->9205 9206 9de50a ___scrt_uninitialize_crt MultiByteToWideChar 9205->9206 9210 9e0c21 9206->9210 9207 9e0d99 9208 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 9207->9208 9209 9ddf35 9208->9209 9209->9176 9210->9207 9211 9dfac8 15 API calls 9210->9211 9213 9e0c47 __alloca_probe_16 9210->9213 9221 9e0ccd 9210->9221 9211->9213 9212 9dfc6d __freea 14 API calls 9212->9207 9214 9de50a ___scrt_uninitialize_crt MultiByteToWideChar 9213->9214 9213->9221 9215 9e0c8c 9214->9215 9215->9221 9232 9de9ce 9215->9232 9218 9e0cbe 9218->9221 9224 9de9ce 6 API calls 9218->9224 9219 9e0cf6 9220 9e0d81 9219->9220 9222 9dfac8 15 API calls 9219->9222 9225 9e0d08 __alloca_probe_16 9219->9225 9223 9dfc6d __freea 14 API calls 9220->9223 9221->9212 9222->9225 9223->9221 9224->9221 9225->9220 9226 9de9ce 6 API calls 9225->9226 9227 9e0d4b 9226->9227 9227->9220 9238 9de586 9227->9238 9229 9e0d65 9229->9220 9230 9e0d6e 9229->9230 9231 9dfc6d __freea 14 API calls 9230->9231 9231->9221 9241 9de6c2 9232->9241 9236 9dea1f LCMapStringW 9237 9de9df 9236->9237 9237->9218 9237->9219 9237->9221 9239 9de59d WideCharToMultiByte 9238->9239 9239->9229 9242 9de7c1 _unexpected 5 API calls 9241->9242 9243 9de6d8 9242->9243 9243->9237 9244 9dea2b 9243->9244 9247 9de6dc 9244->9247 9246 9dea36 9246->9236 9248 9de7c1 _unexpected 5 API calls 9247->9248 9249 9de6f2 9248->9249 9249->9246 9250->9117 9261 9de470 9251->9261 9253 9ddcf9 9254 9de470 41 API calls 9253->9254 9255 9ddd18 9254->9255 9256 9dd52b __freea 14 API calls 9255->9256 9257 9ddcad 9255->9257 9256->9257 9258 9ddccb 9257->9258 9275 9dd68a LeaveCriticalSection 9258->9275 9260 9ddcb9 9260->9074 9262 9de481 9261->9262 9271 9de47d __InternalCxxFrameHandler 9261->9271 9263 9de488 9262->9263 9266 9de49b CallUnexpected 9262->9266 9264 9dbaf8 __freea 14 API calls 9263->9264 9265 9de48d 9264->9265 9267 9dba3a ___std_exception_copy 41 API calls 9265->9267 9268 9de4c9 9266->9268 9269 9de4d2 9266->9269 9266->9271 9267->9271 9270 9dbaf8 __freea 14 API calls 9268->9270 9269->9271 9273 9dbaf8 __freea 14 API calls 9269->9273 9272 9de4ce 9270->9272 9271->9253 9274 9dba3a ___std_exception_copy 41 API calls 9272->9274 9273->9272 9274->9271 9275->9260 9276 9de4f1 GetCommandLineA GetCommandLineW 9795 9dea70 9796 9deaa1 9795->9796 9798 9dea7b 9795->9798 9797 9dea8b FreeLibrary 9797->9798 9798->9796 9798->9797 9277 9d78f3 9282 9d7d47 SetUnhandledExceptionFilter 9277->9282 9279 9d78f8 9283 9dcc66 9279->9283 9281 9d7903 9282->9279 9284 9dcc8c 9283->9284 9285 9dcc72 9283->9285 9284->9281 9285->9284 9286 9dbaf8 __freea 14 API calls 9285->9286 9287 9dcc7c 9286->9287 9288 9dba3a ___std_exception_copy 41 API calls 9287->9288 9289 9dcc87 9288->9289 9289->9281 9799 9dc973 9802 9dc98a 9799->9802 9803 9dc99e 9802->9803 9805 9dc986 9802->9805 9804 9dd52b __freea 14 API calls 9803->9804 9803->9805 9804->9805 9290 9e21f1 9291 9e2215 9290->9291 9292 9e222e 9291->9292 9294 9e3507 __startOneArgErrorHandling 9291->9294 9293 9e2278 9292->9293 9298 9e3313 9292->9298 9295 9e3549 __startOneArgErrorHandling 9294->9295 9306 9e38a1 9294->9306 9299 9e3336 9298->9299 9300 9e3326 DecodePointer 9298->9300 9301 9e3365 9299->9301 9302 9e337a 9299->9302 9303 9e33c1 9299->9303 9300->9299 9301->9303 9304 9dbaf8 __freea 14 API calls 9301->9304 9302->9303 9305 9dbaf8 __freea 14 API calls 9302->9305 9303->9293 9304->9303 9305->9303 9307 9e38da __startOneArgErrorHandling 9306->9307 9309 9e3901 __startOneArgErrorHandling 9307->9309 9317 9e3c0b 9307->9317 9310 9e3944 9309->9310 9311 9e391f 9309->9311 9329 9e3f01 9310->9329 9321 9e3f30 9311->9321 9314 9e393f __startOneArgErrorHandling 9315 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 9314->9315 9316 9e3968 9315->9316 9316->9295 9318 9e3c36 __raise_exc 9317->9318 9319 9e3e2f RaiseException 9318->9319 9320 9e3e48 9319->9320 9320->9309 9322 9e3f3d 9321->9322 9323 9e3f4c __startOneArgErrorHandling 9322->9323 9324 9e3f7b __startOneArgErrorHandling 9322->9324 9325 9e3f01 __startOneArgErrorHandling 14 API calls 9323->9325 9327 9e3fc9 9324->9327 9328 9e3f01 __startOneArgErrorHandling 14 API calls 9324->9328 9326 9e3f65 9325->9326 9326->9314 9327->9314 9328->9327 9330 9e3f0e 9329->9330 9331 9e3f23 9329->9331 9332 9e3f28 9330->9332 9334 9dbaf8 __freea 14 API calls 9330->9334 9333 9dbaf8 __freea 14 API calls 9331->9333 9332->9314 9333->9332 9335 9e3f1b 9334->9335 9335->9314 9806 9dad6f 9807 9db2b7 ___std_exception_destroy 14 API calls 9806->9807 9808 9dad84 _AnonymousOriginator 9807->9808 9809 9d996e 9812 9d99bc 9809->9812 9813 9d9979 9812->9813 9814 9d99c5 9812->9814 9814->9813 9815 9d9b24 CallUnexpected 51 API calls 9814->9815 9816 9d9a00 9815->9816 9817 9d9b24 CallUnexpected 51 API calls 9816->9817 9818 9d9a0b 9817->9818 9819 9dcc9b _unexpected 41 API calls 9818->9819 9820 9d9a13 9819->9820 9821 9dc96a 9822 9d9759 ___scrt_uninitialize_crt 7 API calls 9821->9822 9823 9dc971 9822->9823 9336 9dd4e5 9344 9de884 9336->9344 9339 9dd4f9 9340 9dd391 __freea 14 API calls 9341 9dd501 9340->9341 9342 9dd50e 9341->9342 9349 9dd511 9341->9349 9345 9de7c1 _unexpected 5 API calls 9344->9345 9346 9de8a0 9345->9346 9347 9de8b8 TlsAlloc 9346->9347 9348 9dd4ef 9346->9348 9347->9348 9348->9339 9348->9340 9350 9dd521 9349->9350 9351 9dd51b 9349->9351 9350->9339 9353 9de8c3 9351->9353 9354 9de7c1 _unexpected 5 API calls 9353->9354 9355 9de8df 9354->9355 9356 9de8e8 9355->9356 9357 9de8fa TlsFree 9355->9357 9356->9350 9361 9da5e7 9362 9dcd36 CallUnexpected 41 API calls 9361->9362 9363 9da5ef 9362->9363 9824 9df466 9825 9df395 ___scrt_uninitialize_crt 70 API calls 9824->9825 9826 9df46e 9825->9826 9834 9e1a57 9826->9834 9828 9df473 9844 9e1b02 9828->9844 9831 9df49d 9832 9dd52b __freea 14 API calls 9831->9832 9833 9df4a8 9832->9833 9835 9e1a63 CallCatchBlock 9834->9835 9848 9dd642 EnterCriticalSection 9835->9848 9837 9e1ada 9855 9e1af9 9837->9855 9839 9e1aae DeleteCriticalSection 9842 9dd52b __freea 14 API calls 9839->9842 9843 9e1a6e 9842->9843 9843->9837 9843->9839 9849 9e20a3 9843->9849 9845 9df482 DeleteCriticalSection 9844->9845 9846 9e1b19 9844->9846 9845->9828 9845->9831 9846->9845 9847 9dd52b __freea 14 API calls 9846->9847 9847->9845 9848->9843 9850 9e20b6 ___std_exception_copy 9849->9850 9858 9e1f7e 9850->9858 9852 9e20c2 9853 9db776 ___std_exception_copy 41 API calls 9852->9853 9854 9e20ce 9853->9854 9854->9843 9930 9dd68a LeaveCriticalSection 9855->9930 9857 9e1ae6 9857->9828 9859 9e1f8a CallCatchBlock 9858->9859 9860 9e1fb7 9859->9860 9861 9e1f94 9859->9861 9863 9e1faf 9860->9863 9869 9df4b2 EnterCriticalSection 9860->9869 9862 9db9bd ___std_exception_copy 41 API calls 9861->9862 9862->9863 9863->9852 9865 9e1fd5 9870 9e2015 9865->9870 9867 9e1fe2 9884 9e200d 9867->9884 9869->9865 9871 9e2045 9870->9871 9872 9e2022 9870->9872 9874 9e203d 9871->9874 9875 9df2c7 ___scrt_uninitialize_crt 66 API calls 9871->9875 9873 9db9bd ___std_exception_copy 41 API calls 9872->9873 9873->9874 9874->9867 9876 9e205d 9875->9876 9877 9e1b02 14 API calls 9876->9877 9878 9e2065 9877->9878 9879 9e065c ___scrt_uninitialize_crt 41 API calls 9878->9879 9880 9e2071 9879->9880 9887 9e289c 9880->9887 9883 9dd52b __freea 14 API calls 9883->9874 9929 9df4c6 LeaveCriticalSection 9884->9929 9886 9e2013 9886->9863 9888 9e28c5 9887->9888 9893 9e2078 9887->9893 9889 9e2914 9888->9889 9891 9e28ec 9888->9891 9890 9db9bd ___std_exception_copy 41 API calls 9889->9890 9890->9893 9894 9e280b 9891->9894 9893->9874 9893->9883 9895 9e2817 CallCatchBlock 9894->9895 9902 9df701 EnterCriticalSection 9895->9902 9897 9e2825 9898 9e2856 9897->9898 9903 9e293f 9897->9903 9916 9e2890 9898->9916 9902->9897 9904 9df7d8 ___scrt_uninitialize_crt 41 API calls 9903->9904 9906 9e294f 9904->9906 9905 9e2955 9919 9df747 9905->9919 9906->9905 9908 9df7d8 ___scrt_uninitialize_crt 41 API calls 9906->9908 9915 9e2987 9906->9915 9911 9e297e 9908->9911 9909 9df7d8 ___scrt_uninitialize_crt 41 API calls 9912 9e2993 CloseHandle 9909->9912 9910 9e29ad ___scrt_uninitialize_crt 9910->9898 9913 9df7d8 ___scrt_uninitialize_crt 41 API calls 9911->9913 9912->9905 9914 9e299f GetLastError 9912->9914 9913->9915 9914->9905 9915->9905 9915->9909 9928 9df724 LeaveCriticalSection 9916->9928 9918 9e2879 9918->9893 9920 9df7bd 9919->9920 9921 9df756 9919->9921 9922 9dbaf8 __freea 14 API calls 9920->9922 9921->9920 9926 9df780 9921->9926 9923 9df7c2 9922->9923 9924 9dbae5 ___scrt_uninitialize_crt 14 API calls 9923->9924 9925 9df7ad 9924->9925 9925->9910 9926->9925 9927 9df7a7 SetStdHandle 9926->9927 9927->9925 9928->9918 9929->9886 9930->9857 9364 9dace0 9367 9dad13 9364->9367 9370 9db254 9367->9370 9371 9db261 ___std_exception_copy 9370->9371 9375 9dacee 9370->9375 9372 9db28e 9371->9372 9371->9375 9376 9dcd85 9371->9376 9374 9dbb0b ___std_exception_copy 14 API calls 9372->9374 9374->9375 9377 9dcda1 9376->9377 9378 9dcd93 9376->9378 9379 9dbaf8 __freea 14 API calls 9377->9379 9378->9377 9380 9dcdb9 9378->9380 9384 9dcda9 9379->9384 9382 9dcdb3 9380->9382 9383 9dbaf8 __freea 14 API calls 9380->9383 9381 9dba3a ___std_exception_copy 41 API calls 9381->9382 9382->9372 9383->9384 9384->9381 9385 9da3e3 9386 9dabde __InternalCxxFrameHandler 54 API calls 9385->9386 9387 9da409 9386->9387 9388 9e20e1 9389 9e2101 9388->9389 9392 9e2138 9389->9392 9391 9e212b 9393 9e213f 9392->9393 9394 9e21a0 9393->9394 9398 9e215f 9393->9398 9396 9e31ce 9394->9396 9401 9e32d7 9394->9401 9396->9391 9398->9396 9399 9e32d7 20 API calls 9398->9399 9400 9e31fe 9399->9400 9400->9391 9402 9e32e0 9401->9402 9405 9e374f 9402->9405 9406 9e378e __startOneArgErrorHandling 9405->9406 9409 9e3810 __startOneArgErrorHandling 9406->9409 9413 9e3be8 9406->9413 9408 9e3f01 __startOneArgErrorHandling 14 API calls 9410 9e3845 9408->9410 9409->9408 9409->9410 9411 9d73ee __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 9410->9411 9412 9e21ee 9411->9412 9412->9391 9414 9e3c0b __raise_exc RaiseException 9413->9414 9415 9e3c06 9414->9415 9415->9409 9416 9d65e2 9417 9d65f5 9416->9417 9418 9d65ec 9416->9418 9417->9418 9419 9d6605 HeapReAlloc 9417->9419 9419->9418

                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                              Function 009D6C1E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 009D6C2C
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 009D6C33
                                                                                                                                                                                              • LoadLibraryExW.KERNELBASE(?,00000000,00000000), ref: 009D6C72
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,DllEntry), ref: 009D6C8D
                                                                                                                                                                                              • GetCommandLineW.KERNEL32(?), ref: 009D6C9C
                                                                                                                                                                                              • FreeLibrary.KERNELBASE(00000000), ref: 009D6CAF
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AddressLibraryProc$CommandFreeHandleLineLoadModule
                                                                                                                                                                                              • String ID: DllEntry$SetDefaultDllDirectories$kernel32.dll
                                                                                                                                                                                              • API String ID: 1042781669-3472957018
                                                                                                                                                                                              • Opcode ID: dd0b6f0b2ef7c002f899dfc00b0716ef1611d4e265ef7439ab9f4b153629d926
                                                                                                                                                                                              • Instruction ID: 0a53bc8c64c9b5a26bdf2d128fbe451e1fcdb083643d30e56a07d596ac708157
                                                                                                                                                                                              • Opcode Fuzzy Hash: dd0b6f0b2ef7c002f899dfc00b0716ef1611d4e265ef7439ab9f4b153629d926
                                                                                                                                                                                              • Instruction Fuzzy Hash: 9C110C329E4215BBC710ABF49C49F6E7768DF84755B118016F981F7390EA249D0067B1
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009D6A8C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 009D6AE1
                                                                                                                                                                                              • PathRemoveFileSpecW.SHLWAPI(?,?,?,00000104), ref: 009D6AFC
                                                                                                                                                                                              • PathAppendW.SHLWAPI(?,goopdate.dll,?,?,00000104), ref: 009D6B2B
                                                                                                                                                                                                • Part of subcall function 009D6820: GetLastError.KERNEL32(009D6AF0,?,?,00000104), ref: 009D6820
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FilePath$AppendErrorLastModuleNameRemoveSpec
                                                                                                                                                                                              • String ID: goopdate.dll
                                                                                                                                                                                              • API String ID: 3739599460-235033069
                                                                                                                                                                                              • Opcode ID: a85bc143a5484cab7a8086045e9c2c6ef341313a6e7eee86db692233c9fdbfae
                                                                                                                                                                                              • Instruction ID: 73a31311f3e35c57ff6e37a25ee9e4ef747f52739d6f9898fd9615388e6939d5
                                                                                                                                                                                              • Opcode Fuzzy Hash: a85bc143a5484cab7a8086045e9c2c6ef341313a6e7eee86db692233c9fdbfae
                                                                                                                                                                                              • Instruction Fuzzy Hash: 6E4153B198521D96CB20EBB0DC85FDAB77C9B84344F10C5E7B545E3242EA34DE858B60
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009DE6F6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 67 9de6f6-9de702 68 9de794-9de797 67->68 69 9de79d 68->69 70 9de707-9de718 68->70 71 9de79f-9de7a3 69->71 72 9de71a-9de71d 70->72 73 9de725-9de73e LoadLibraryExW 70->73 74 9de7bd-9de7bf 72->74 75 9de723 72->75 76 9de7a4-9de7b4 73->76 77 9de740-9de749 GetLastError 73->77 74->71 79 9de791 75->79 76->74 78 9de7b6-9de7b7 FreeLibrary 76->78 80 9de74b-9de75d call 9dcec8 77->80 81 9de782-9de78f 77->81 78->74 79->68 80->81 84 9de75f-9de771 call 9dcec8 80->84 81->79 84->81 87 9de773-9de780 LoadLibraryExW 84->87 87->76 87->81
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,009DE803,009DC8BB,0000000C,?,00000000,00000000,?,009DE95D,00000021,FlsSetValue,009D2924,009D292C,?), ref: 009DE7B7
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FreeLibrary
                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                              • API String ID: 3664257935-537541572
                                                                                                                                                                                              • Opcode ID: 13c70ed6c46924cdca20c97f370c4c8ee6aa92c45c75e11248d3112ec2f02f5b
                                                                                                                                                                                              • Instruction ID: 897fd073ddbf5f23f840cb0f345e06887a3f9be8ca929569e668c94c359816c5
                                                                                                                                                                                              • Opcode Fuzzy Hash: 13c70ed6c46924cdca20c97f370c4c8ee6aa92c45c75e11248d3112ec2f02f5b
                                                                                                                                                                                              • Instruction Fuzzy Hash: D3215C73A85251ABCB61AB64ECC0A5A776CEF51771F208222ED15AF3D0E734EE00D6D1
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009D69EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61registryCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 88 9d69ee-9d6a1d RegOpenKeyExW 89 9d6a1f 88->89 90 9d6a2b-9d6a63 call 9d6dfe SHQueryValueExW call 9d6d16 88->90 91 9d6a88-9d6a8b 89->91 92 9d6a21-9d6a29 89->92 96 9d6a68-9d6a6a 90->96 92->91 97 9d6a6c 96->97 98 9d6a7b-9d6a83 96->98 99 9d6a6e-9d6a71 97->99 100 9d6a77-9d6a79 97->100 98->91 99->100 100->91
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • RegOpenKeyExW.KERNELBASE(?,Software\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019},00000000,00020019,?,?,?), ref: 009D6A15
                                                                                                                                                                                              • SHQueryValueExW.SHLWAPI(?,009D5D10,00000000,?,00000000,?,00000032,?,?), ref: 009D6A58
                                                                                                                                                                                              Strings
                                                                                                                                                                                              • Software\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}, xrefs: 009D6A07
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: OpenQueryValue
                                                                                                                                                                                              • String ID: Software\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}
                                                                                                                                                                                              • API String ID: 4153817207-790910960
                                                                                                                                                                                              • Opcode ID: db091631e8fae7e74fde1aa312ca9e48b434ecccb8ac6fc0e9d0293393859969
                                                                                                                                                                                              • Instruction ID: 302444b339d22d84b8ea5fbe6b598e1d05df1e30cfa7e5c761e85ca680d5b9b1
                                                                                                                                                                                              • Opcode Fuzzy Hash: db091631e8fae7e74fde1aa312ca9e48b434ecccb8ac6fc0e9d0293393859969
                                                                                                                                                                                              • Instruction Fuzzy Hash: F9118A75D80259AB8B109FA99D45EBFBBBDEB80710F10C257B855F62D0D6748E00D7A0
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009DBEC7 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,?,009DBEC1,?,009DB83D,?,?,A806529B,009DB83D,?), ref: 009DBED8
                                                                                                                                                                                              • TerminateProcess.KERNEL32(00000000,?,009DBEC1,?,009DB83D,?,?,A806529B,009DB83D,?), ref: 009DBEDF
                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 009DBEF1
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                              • Opcode ID: 959392e68480442a949176aa93cca8969c0e7d6721941639ce64773259f61146
                                                                                                                                                                                              • Instruction ID: 1c457979a8e77707c45467a3e2f99e8da69238530aaff2f9ef3828f659874493
                                                                                                                                                                                              • Opcode Fuzzy Hash: 959392e68480442a949176aa93cca8969c0e7d6721941639ce64773259f61146
                                                                                                                                                                                              • Instruction Fuzzy Hash: 6CD09E32058144EBCF113FA1ED4DA997F2ABF44352B058415BA194A131DB319E52AAE2
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009D6887 Relevance: 3.1, APIs: 2, Instructions: 122COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000104), ref: 009D68B9
                                                                                                                                                                                              • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,00000000,00000104,?,?,00000000), ref: 009D697C
                                                                                                                                                                                                • Part of subcall function 009D6F7D: FindResourceExW.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,00000000,?,?,009D6912,-00000010), ref: 009D6FAE
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FileFindFolderModuleNamePathResource
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2248019921-0
                                                                                                                                                                                              • Opcode ID: f57325f77f5967b3959083fed10a41d94b5ee001ce6826d890bcbb4ae038f6ee
                                                                                                                                                                                              • Instruction ID: 96d0f26bbf6982729de1d06d5cd3969dbebbcb63b5e7c744c192e124a0c9b8a7
                                                                                                                                                                                              • Opcode Fuzzy Hash: f57325f77f5967b3959083fed10a41d94b5ee001ce6826d890bcbb4ae038f6ee
                                                                                                                                                                                              • Instruction Fuzzy Hash: 73416371D80119ABCB04EFB8DDA5AFEB779AF90300B50856AA912A7381EB345F05CB50
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009DE7C1 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 167 9de7c1-9de7e9 168 9de7ef-9de7f1 167->168 169 9de7eb-9de7ed 167->169 171 9de7f7-9de7fe call 9de6f6 168->171 172 9de7f3-9de7f5 168->172 170 9de840-9de843 169->170 174 9de803-9de807 171->174 172->170 175 9de809-9de817 GetProcAddress 174->175 176 9de826-9de83d 174->176 175->176 177 9de819-9de824 call 9dbd26 175->177 178 9de83f 176->178 177->178 178->170
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID:
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                              • Opcode ID: dabb41d1c3d704d6f18cbdea68554700fa106084f49ccfbf59597c4f4d78a050
                                                                                                                                                                                              • Instruction ID: 8ef8e1d3bbf8b268df7a3455a7141c30ad06373a959dbd78bfe02c469b87c7fe
                                                                                                                                                                                              • Opcode Fuzzy Hash: dabb41d1c3d704d6f18cbdea68554700fa106084f49ccfbf59597c4f4d78a050
                                                                                                                                                                                              • Instruction Fuzzy Hash: B301F1337542619BDB26AE69EC8096A339AEBC5370725C522FA04CF284DA30DC01A7E1
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009DD6D2 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 181 9dd6d2-9dd6dd 182 9dd6df-9dd6e9 181->182 183 9dd6eb-9dd6f1 181->183 182->183 184 9dd71f-9dd72a call 9dbaf8 182->184 185 9dd70a-9dd71b RtlAllocateHeap 183->185 186 9dd6f3-9dd6f4 183->186 191 9dd72c-9dd72e 184->191 187 9dd71d 185->187 188 9dd6f6-9dd6fd call 9dcc5f 185->188 186->185 187->191 188->184 194 9dd6ff-9dd708 call 9ded5b 188->194 194->184 194->185
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000008,?,?,?,009DD3DE,00000001,00000364,?,00000006,000000FF,?,009DBB6F,00000000,009DC8BB,00000004), ref: 009DD713
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AllocateHeap
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1279760036-0
                                                                                                                                                                                              • Opcode ID: 400bab88fb4c628c9f979055dd26afec74fe0439521b8461d0f935b969ec69ca
                                                                                                                                                                                              • Instruction ID: bcd9d519f5dd465318173297cd517f8e1b51a087241cb2ffeb78f661f755abb4
                                                                                                                                                                                              • Opcode Fuzzy Hash: 400bab88fb4c628c9f979055dd26afec74fe0439521b8461d0f935b969ec69ca
                                                                                                                                                                                              • Instruction Fuzzy Hash: F2F0E9725D6120A79B215A769C45B6B775CAF817A0B14C593F908EE394CA20DC0086E0
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                              Function 009DD9B3 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 009DDA4E
                                                                                                                                                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 009DDAC9
                                                                                                                                                                                              • FindClose.KERNEL32(00000000), ref: 009DDAEB
                                                                                                                                                                                              • FindClose.KERNEL32(00000000), ref: 009DDB0E
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Find$CloseFile$FirstNext
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1164774033-0
                                                                                                                                                                                              • Opcode ID: 0d8ca219530541a0bbcbc7c51d0d021caa1db3b07bc2e302377918d83c04feea
                                                                                                                                                                                              • Instruction ID: c6eff82a1016bb5822d2e1e2514dfabe5134740305d5b911cb954260b9edfce8
                                                                                                                                                                                              • Opcode Fuzzy Hash: 0d8ca219530541a0bbcbc7c51d0d021caa1db3b07bc2e302377918d83c04feea
                                                                                                                                                                                              • Instruction Fuzzy Hash: 6441D97194A629AFDB20DFA4DCC8ABAB77CEB84304F14C197E405D7244E7349E84CB54
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009D7BB0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009D7BBC
                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32 ref: 009D7C88
                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009D7CA8
                                                                                                                                                                                              • UnhandledExceptionFilter.KERNEL32(?), ref: 009D7CB2
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 254469556-0
                                                                                                                                                                                              • Opcode ID: c614c064f6e68763aeff192030ef4124c4abdec0ebf6008d8cf86295416c45c9
                                                                                                                                                                                              • Instruction ID: cd389393b731fff508ce0af61c347a99a13cc362baa04a4115d89beaa7863b7f
                                                                                                                                                                                              • Opcode Fuzzy Hash: c614c064f6e68763aeff192030ef4124c4abdec0ebf6008d8cf86295416c45c9
                                                                                                                                                                                              • Instruction Fuzzy Hash: CE314B75D59218DFDB11DFA0D9897CDBBB8AF04300F1041AAE40CAB390EB715A84DF45
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009D7423 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • InitializeCriticalSectionAndSpinCount.KERNEL32(009E592C,00000FA0,?,?,009D7401), ref: 009D742F
                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,009D7401), ref: 009D743A
                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,009D7401), ref: 009D744B
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 009D745D
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 009D746B
                                                                                                                                                                                              • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,009D7401), ref: 009D748E
                                                                                                                                                                                              • DeleteCriticalSection.KERNEL32(009E592C,00000007,?,?,009D7401), ref: 009D74AA
                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,009D7401), ref: 009D74BA
                                                                                                                                                                                              Strings
                                                                                                                                                                                              • api-ms-win-core-synch-l1-2-0.dll, xrefs: 009D7435
                                                                                                                                                                                              • WakeAllConditionVariable, xrefs: 009D7463
                                                                                                                                                                                              • kernel32.dll, xrefs: 009D7446
                                                                                                                                                                                              • SleepConditionVariableCS, xrefs: 009D7457
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                                              • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                                              • API String ID: 2565136772-3242537097
                                                                                                                                                                                              • Opcode ID: 316f82bbca610b485108066037de11ea70286032b71cbe225a8549446b91a449
                                                                                                                                                                                              • Instruction ID: ee2e899b0feac12ea72c193c731141553d8895d06ce814881b69cdfb3c6cccb0
                                                                                                                                                                                              • Opcode Fuzzy Hash: 316f82bbca610b485108066037de11ea70286032b71cbe225a8549446b91a449
                                                                                                                                                                                              • Instruction Fuzzy Hash: 580128357DC780BBD7221FF5BC8CE6ABA5C9B84766B018012F904DA3A1EB64CC00E661
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009DA670 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • IsInExceptionSpec.LIBVCRUNTIME ref: 009DA76D
                                                                                                                                                                                              • type_info::operator==.LIBVCRUNTIME ref: 009DA78F
                                                                                                                                                                                              • ___TypeMatch.LIBVCRUNTIME ref: 009DA89E
                                                                                                                                                                                              • IsInExceptionSpec.LIBVCRUNTIME ref: 009DA970
                                                                                                                                                                                              • _UnwindNestedFrames.LIBCMT ref: 009DA9F4
                                                                                                                                                                                              • CallUnexpected.LIBVCRUNTIME ref: 009DAA0F
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                              • API String ID: 2123188842-393685449
                                                                                                                                                                                              • Opcode ID: 70571cb5826f97e83715fbb23d66c56866904f78dd6f7c6cac34381734a73f87
                                                                                                                                                                                              • Instruction ID: 3adc370bca6707a26c1a281dde429ee57781008dfa950865c45208c6f39d7a10
                                                                                                                                                                                              • Opcode Fuzzy Hash: 70571cb5826f97e83715fbb23d66c56866904f78dd6f7c6cac34381734a73f87
                                                                                                                                                                                              • Instruction Fuzzy Hash: 1CB17A75C40209EFCF29DFA4D981AAEB7B9FF54310B15815BE8106B312D334DA61CB92
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009D97B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 009D97E7
                                                                                                                                                                                              • ___except_validate_context_record.LIBVCRUNTIME ref: 009D97EF
                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 009D9878
                                                                                                                                                                                              • __IsNonwritableInCurrentImage.LIBCMT ref: 009D98A3
                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 009D98F8
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                              • API String ID: 1170836740-1018135373
                                                                                                                                                                                              • Opcode ID: 997ba8b8867d0350970819e3454f57e919e926eb8fb5841b83ad74cfa753b4a9
                                                                                                                                                                                              • Instruction ID: 7d7f2ca55c60a88f0f8815d8edeea30069d14ffed204824295f5012115ae6810
                                                                                                                                                                                              • Opcode Fuzzy Hash: 997ba8b8867d0350970819e3454f57e919e926eb8fb5841b83ad74cfa753b4a9
                                                                                                                                                                                              • Instruction Fuzzy Hash: 7D41B134A40209EBCF10EF68C880B9EBBB5AF86714F14C156F8159B392D7319E05DB90
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009D9B32 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,009D9B29,009D9ABA,009D7D97), ref: 009D9B40
                                                                                                                                                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009D9B4E
                                                                                                                                                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009D9B67
                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,009D9B29,009D9ABA,009D7D97), ref: 009D9BB9
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3852720340-0
                                                                                                                                                                                              • Opcode ID: 66a2f90dda97f77bfdc1d492f857fa34d46dcc64f4734a4d5e4d3f6f551e2739
                                                                                                                                                                                              • Instruction ID: a7ab48251d31fc717170512a3f9e5b58edcfb048bba8d84f33882732ea48fddd
                                                                                                                                                                                              • Opcode Fuzzy Hash: 66a2f90dda97f77bfdc1d492f857fa34d46dcc64f4734a4d5e4d3f6f551e2739
                                                                                                                                                                                              • Instruction Fuzzy Hash: 67014C321AD7115EE62037B87CC5B272768DB91BBA722833BF515A83E1EF154C01A180
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009D9E17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,009D9ED8,?,?,009E5CEC,00000000,?,009DA003,00000004,InitializeCriticalSectionEx,009D1C14,InitializeCriticalSectionEx,00000000), ref: 009D9EA7
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FreeLibrary
                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                              • API String ID: 3664257935-2084034818
                                                                                                                                                                                              • Opcode ID: 581ce8d737bfe06c7a5a3011e999d32b4577627efe2b357bb69b1b5334eb23c3
                                                                                                                                                                                              • Instruction ID: be2166494d13929ffaeef4eca0110630cc17b374171feb385f76a18e13acfa41
                                                                                                                                                                                              • Opcode Fuzzy Hash: 581ce8d737bfe06c7a5a3011e999d32b4577627efe2b357bb69b1b5334eb23c3
                                                                                                                                                                                              • Instruction Fuzzy Hash: 3D11CA32AC5625BBCF22EBA8EC41B5D7398AF41761F158612E901EB3C0D770ED0096F1
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009DBF1A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,A806529B,?,?,00000000,009E44E2,000000FF,?,009DBEED,?,?,009DBEC1,?), ref: 009DBF4F
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009DBF61
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,00000000,009E44E2,000000FF,?,009DBEED,?,?,009DBEC1,?), ref: 009DBF83
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                              • Opcode ID: 43a78f33cf169393fde9a2831f7630f633a41839c6c37102e80a71a9ca3126fd
                                                                                                                                                                                              • Instruction ID: 372d536c65484ecc1a22d6bed1b464acd4bbc6623475a57f09ec887393745aab
                                                                                                                                                                                              • Opcode Fuzzy Hash: 43a78f33cf169393fde9a2831f7630f633a41839c6c37102e80a71a9ca3126fd
                                                                                                                                                                                              • Instruction Fuzzy Hash: 9001F736658656EBCB119F94CC04BAEFBBCFB04715F018526F811A63D0D7749C00CB90
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009E0BC0 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • __alloca_probe_16.LIBCMT ref: 009E0C47
                                                                                                                                                                                              • __alloca_probe_16.LIBCMT ref: 009E0D08
                                                                                                                                                                                              • __freea.LIBCMT ref: 009E0D6F
                                                                                                                                                                                                • Part of subcall function 009DFAC8: HeapAlloc.KERNEL32(00000000,00000000,009DC8BB,?,009DD5AD,?,00000000,?,009DBB6F,00000000,009DC8BB,00000004,?,00000000,?,009DC6B5), ref: 009DFAFA
                                                                                                                                                                                              • __freea.LIBCMT ref: 009E0D84
                                                                                                                                                                                              • __freea.LIBCMT ref: 009E0D94
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: __freea$__alloca_probe_16$AllocHeap
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1096550386-0
                                                                                                                                                                                              • Opcode ID: cd2fd7744f84cfe3058ed023732d431b5f6f033160ac38253453a8040443f3f2
                                                                                                                                                                                              • Instruction ID: bd4c3252968b2bb06bbd5e400e89ba90fc46a4e4523cbc4bec7af13b3064991c
                                                                                                                                                                                              • Opcode Fuzzy Hash: cd2fd7744f84cfe3058ed023732d431b5f6f033160ac38253453a8040443f3f2
                                                                                                                                                                                              • Instruction Fuzzy Hash: 4751C87260024AAFDF229FA6DC81EBF77ADEF84754B154529FC08D6250E7B0DC9087A0
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009E0FA1 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetConsoleOutputCP.KERNEL32(A806529B,?,00000000,?), ref: 009E1004
                                                                                                                                                                                                • Part of subcall function 009DE586: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,009E0D65,?,00000000,-00000008), ref: 009DE632
                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009E125F
                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009E12A7
                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 009E134A
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2112829910-0
                                                                                                                                                                                              • Opcode ID: 3f82aa27604d859963081d292286e49deb961c9bb151f959f5e00ba29058bd3c
                                                                                                                                                                                              • Instruction ID: 0b1e487ae181768640f505444d8401b7f56b4639d49caeaf55af887b60d6fe37
                                                                                                                                                                                              • Opcode Fuzzy Hash: 3f82aa27604d859963081d292286e49deb961c9bb151f959f5e00ba29058bd3c
                                                                                                                                                                                              • Instruction Fuzzy Hash: B9D15775D042989FCB16CFE9D880AADBBB8FF48310F18452AE966EB351D730AC41CB50
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009DA419 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AdjustPointer
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1740715915-0
                                                                                                                                                                                              • Opcode ID: 0e066a512d2c0f5dd365af7e49ff7af785f7940da3814e320ff85863d024fd12
                                                                                                                                                                                              • Instruction ID: d60df93a23590283d185272b09633c941998485be7e75832d0f1efad0875d837
                                                                                                                                                                                              • Opcode Fuzzy Hash: 0e066a512d2c0f5dd365af7e49ff7af785f7940da3814e320ff85863d024fd12
                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F51E2726852069FDB299F54E841B6E77A8FF90314F14C42BF805873A1E771EC60CB92
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009E27B6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,009E1F6A,?,00000001,?,?,?,009E139E,?,?,00000000), ref: 009E27CD
                                                                                                                                                                                              • GetLastError.KERNEL32(?,009E1F6A,?,00000001,?,?,?,009E139E,?,?,00000000,?,?,?,009E1925,?), ref: 009E27D9
                                                                                                                                                                                                • Part of subcall function 009E279F: CloseHandle.KERNEL32(FFFFFFFE,009E27E9,?,009E1F6A,?,00000001,?,?,?,009E139E,?,?,00000000,?,?), ref: 009E27AF
                                                                                                                                                                                              • ___initconout.LIBCMT ref: 009E27E9
                                                                                                                                                                                                • Part of subcall function 009E2761: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009E2790,009E1F57,?,?,009E139E,?,?,00000000,?), ref: 009E2774
                                                                                                                                                                                              • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,009E1F6A,?,00000001,?,?,?,009E139E,?,?,00000000,?), ref: 009E27FE
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2744216297-0
                                                                                                                                                                                              • Opcode ID: 59c9e0f9246ea8c36399c27ff0bb57a62dd2f74b1cb3bcbb1af73a7811a16537
                                                                                                                                                                                              • Instruction ID: 93d2b8f70b3b35f40f85b8459bbaa0dfffa1ef1887e73a6988f1a7fe718fb9cb
                                                                                                                                                                                              • Opcode Fuzzy Hash: 59c9e0f9246ea8c36399c27ff0bb57a62dd2f74b1cb3bcbb1af73a7811a16537
                                                                                                                                                                                              • Instruction Fuzzy Hash: 92F01C364192A4BBCF222FD2DC48A997F6AFB483A1F054010FE1889131C632CC20EB91
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009D7593 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • SleepConditionVariableCS.KERNELBASE(?,009D7530,00000064), ref: 009D75B6
                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(009E592C,?,?,009D7530,00000064,?,009D6688,009E64A0,?,?,009D6DDF,?,009D6898), ref: 009D75C0
                                                                                                                                                                                              • WaitForSingleObjectEx.KERNEL32(?,00000000,?,009D7530,00000064,?,009D6688,009E64A0,?,?,009D6DDF,?,009D6898), ref: 009D75D1
                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(009E592C,?,009D7530,00000064,?,009D6688,009E64A0,?,?,009D6DDF,?,009D6898), ref: 009D75D8
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3269011525-0
                                                                                                                                                                                              • Opcode ID: 84557269e152629549915cef350242fb15208606b573a0c3815ca41685e3f7e0
                                                                                                                                                                                              • Instruction ID: 920acc93ecb5d45c9822149ccb937ae795baa919369b6494f25f27ef16b4b63a
                                                                                                                                                                                              • Opcode Fuzzy Hash: 84557269e152629549915cef350242fb15208606b573a0c3815ca41685e3f7e0
                                                                                                                                                                                              • Instruction Fuzzy Hash: 7DE02B3555D664FBCB121FD0FC48AEEBF29EB0C735B410010F5095E12187200D00E7D2
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009DAA1A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 009DAA3F
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: EncodePointer
                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                              • API String ID: 2118026453-2084237596
                                                                                                                                                                                              • Opcode ID: 98af937db718dbcc5cea9cf67f550083983b59b695001616261f97b892860601
                                                                                                                                                                                              • Instruction ID: 946589b1f856d4440052eb5bfa7c94ca5d8e1a46521474424b08e74e72e40a4e
                                                                                                                                                                                              • Opcode Fuzzy Hash: 98af937db718dbcc5cea9cf67f550083983b59b695001616261f97b892860601
                                                                                                                                                                                              • Instruction Fuzzy Hash: 58416C71940109AFCF15DF98DD81AEEBBBAFF48304F18815BF90467221D3399961DB52
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 009D72D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                                • Part of subcall function 009D6511: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 009D6516
                                                                                                                                                                                                • Part of subcall function 009D6511: GetLastError.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 009D6520
                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32(?,?,?,009D648A), ref: 009D7309
                                                                                                                                                                                              • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,009D648A), ref: 009D7318
                                                                                                                                                                                              Strings
                                                                                                                                                                                              • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 009D7313
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000002.00000002.1680412159.00000000009D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 009D0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000002.00000002.1680389365.00000000009D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680433636.00000000009E5000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000002.00000002.1680451635.00000000009E7000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_9d0000_BraveUpdate.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                                                                                                                              • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                              • API String ID: 450123788-631824599
                                                                                                                                                                                              • Opcode ID: 94afb6970adac77d1a8d200e8332e5540529b3a51569eb5ea6c535dd8b1aabc2
                                                                                                                                                                                              • Instruction ID: 79e02b9452416cc6d50fb2b870c0a40fff06937bd80c62014ec4ceff22e42552
                                                                                                                                                                                              • Opcode Fuzzy Hash: 94afb6970adac77d1a8d200e8332e5540529b3a51569eb5ea6c535dd8b1aabc2
                                                                                                                                                                                              • Instruction Fuzzy Hash: 38E06D702883809BD370AFA4F904306FAE8AB00795F00C95EE886C6341EBB4E884DB51
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                              Function 00007FF7682C44A8 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 152registryCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: PrivateProfile$CloseOpenQueryValue
                                                                                                                                                                                              • String ID: AppendToFile$EnableLogging$IsEnabledLogToFile$LogToOutputDebug$LoggingLevel$LoggingSettings$ShowTime$Software\BraveSoftware\UpdateDev\
                                                                                                                                                                                              • API String ID: 2210674228-3529394150
                                                                                                                                                                                              • Opcode ID: e76eabe69dcbfb0e1bb1f957a59a9243cd2566a70f477710c060f4ab32d6764c
                                                                                                                                                                                              • Instruction ID: be41fede6ddf38e90953e81ca9afe8faa9cad16742e0e94aab090e81d21d62a5
                                                                                                                                                                                              • Opcode Fuzzy Hash: e76eabe69dcbfb0e1bb1f957a59a9243cd2566a70f477710c060f4ab32d6764c
                                                                                                                                                                                              • Instruction Fuzzy Hash: 6D61AF22A04A81DAEB14AF39D5447A9FBA0FF04BACF844136DE1C03795DF38D568C718
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C3A10 Relevance: 4.5, APIs: 3, Instructions: 33libraryloaderCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • LoadLibraryW.KERNELBASE ref: 00007FF7682C3A25
                                                                                                                                                                                              • GetProcAddress.KERNEL32 ref: 00007FF7682C3A42
                                                                                                                                                                                              • FreeLibrary.KERNELBASE ref: 00007FF7682C3A62
                                                                                                                                                                                                • Part of subcall function 00007FF7682C39C0: GetLastError.KERNEL32(?,?,?,00007FF7682C3B80,?,?,?,00007FF7682C42C9,?,?,?,?,00007FF7682C1031), ref: 00007FF7682C39C6
                                                                                                                                                                                                • Part of subcall function 00007FF7682C39C0: RaiseException.KERNEL32(?,?,?,00007FF7682C3B80,?,?,?,00007FF7682C42C9,?,?,?,?,00007FF7682C1031), ref: 00007FF7682C39FF
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Library$AddressErrorExceptionFreeLastLoadProcRaise
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 386220097-0
                                                                                                                                                                                              • Opcode ID: 55289a7fcf567d6fc37604f5a9609b51a8c42d30ea13611f0b10e3126723dc72
                                                                                                                                                                                              • Instruction ID: 80f828b68e5029835cecb21d0b9104287ecb5b31a4c42a8a0f970a43d0435f9b
                                                                                                                                                                                              • Opcode Fuzzy Hash: 55289a7fcf567d6fc37604f5a9609b51a8c42d30ea13611f0b10e3126723dc72
                                                                                                                                                                                              • Instruction Fuzzy Hash: C0F09C22A08743C5FE946B167848239D5957F58BD8F5C9834DD5E07744DE3CD4618B24
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682D0820 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AddressFreeLibraryProc
                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                              • API String ID: 3013587201-537541572
                                                                                                                                                                                              • Opcode ID: 074aebfcd047c6dbd580fc05c8189f2518d4116660b9562a03a151471e01fd58
                                                                                                                                                                                              • Instruction ID: c4878e8edf77caeaaac26316fdb4141b24ecf469d05bd11ca5a2afc0615b7452
                                                                                                                                                                                              • Opcode Fuzzy Hash: 074aebfcd047c6dbd580fc05c8189f2518d4116660b9562a03a151471e01fd58
                                                                                                                                                                                              • Instruction Fuzzy Hash: D741B263B19642C9FB51EB16A8043F9EBD1BF45BE8F848135DD0D47798DE3CE0458268
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C4BDC Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 67libraryloaderCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AddressCommandHandleLineModuleProc
                                                                                                                                                                                              • String ID: SetDefaultDllDirectories$kernel32.dll$unregister$user
                                                                                                                                                                                              • API String ID: 147197560-815688805
                                                                                                                                                                                              • Opcode ID: 5709c1a7cf0b43fb8a302db99dfee1deae5af6bda4fbedd289ff6e36927d3558
                                                                                                                                                                                              • Instruction ID: b9b8ee3a39649ff9a99abeab93a92c1b6198d691a4d6f63b4e1c92ef93dae2bd
                                                                                                                                                                                              • Opcode Fuzzy Hash: 5709c1a7cf0b43fb8a302db99dfee1deae5af6bda4fbedd289ff6e36927d3558
                                                                                                                                                                                              • Instruction Fuzzy Hash: 3E21D462B18A42C6DE50BB28E8501B9E360FF84BA8B845331E66D436F5DF2CD648CB14
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C4A9C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32registryCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CloseOpenOverridePredef
                                                                                                                                                                                              • String ID: Software\Classes
                                                                                                                                                                                              • API String ID: 2630863477-1656466771
                                                                                                                                                                                              • Opcode ID: c313f1374a35ba85ed93cb0d8f175837ed073ca8541d3e038ce952050618a241
                                                                                                                                                                                              • Instruction ID: c3912cd42bccdd2436a4349a98de897d77202fe186c505ce2f9be3adaa687442
                                                                                                                                                                                              • Opcode Fuzzy Hash: c313f1374a35ba85ed93cb0d8f175837ed073ca8541d3e038ce952050618a241
                                                                                                                                                                                              • Instruction Fuzzy Hash: EBF0A462B18612C9FB606B69A490336E6E0EF447A5FA00235EE6D816E4DE1DD054DA3C
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C4148 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 157stringCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 87 7ff7682c4148-7ff7682c4193 call 7ff7682c18e4 call 7ff7682c1768 call 7ff7682c18e4 call 7ff7682c1e1c 96 7ff7682c4224-7ff7682c424c call 7ff7682c1230 call 7ff7682c147c 87->96 97 7ff7682c4199-7ff7682c41ac lstrcmpiW 87->97 113 7ff7682c4252-7ff7682c42a3 InitializeCriticalSection call 7ff7682c147c 96->113 114 7ff7682c43ef-7ff7682c4420 call 7ff7682c1230 96->114 99 7ff7682c41ae-7ff7682c41d6 call 7ff7682cb924 call 7ff7682c3cd4 * 2 97->99 100 7ff7682c41db-7ff7682c41ed 97->100 99->100 103 7ff7682c41ef-7ff7682c41f2 100->103 104 7ff7682c41f8-7ff7682c4203 100->104 103->104 107 7ff7682c4211-7ff7682c4223 104->107 108 7ff7682c4205-7ff7682c420b 104->108 108->107 122 7ff7682c43e4-7ff7682c43ee call 7ff7682c1230 113->122 123 7ff7682c42a9-7ff7682c42d2 call 7ff7682c3acc 113->123 124 7ff7682c4422-7ff7682c442c 114->124 122->114 136 7ff7682c42d4-7ff7682c42fe call 7ff7682c2f40 call 7ff7682cb924 call 7ff7682c3cd4 123->136 137 7ff7682c4303-7ff7682c432f call 7ff7682c1a28 123->137 126 7ff7682c442e-7ff7682c443c 124->126 127 7ff7682c444d-7ff7682c44a4 call 7ff7682c1ac4 call 7ff7682c47b4 call 7ff7682c1ac4 124->127 128 7ff7682c4449-7ff7682c444b 126->128 129 7ff7682c443e-7ff7682c4441 126->129 128->124 129->128 136->137 147 7ff7682c4331-7ff7682c4334 137->147 148 7ff7682c433a-7ff7682c434e 137->148 147->148 151 7ff7682c4350-7ff7682c4353 148->151 152 7ff7682c4359-7ff7682c43ba call 7ff7682c6840 call 7ff7682c4148 call 7ff7682c2f40 148->152 151->152 161 7ff7682c43c5-7ff7682c43d3 call 7ff7682c44a8 152->161 162 7ff7682c43bc-7ff7682c43bf 152->162 164 7ff7682c43d8-7ff7682c43e3 161->164 162->161
                                                                                                                                                                                              APIs
                                                                                                                                                                                                • Part of subcall function 00007FF7682C18E4: PathRemoveExtensionW.SHLWAPI(?,?,?,00007FF7682C4166,?,?,?,00007FF7682C4397,?,?,?,?,00007FF7682C1031), ref: 00007FF7682C1940
                                                                                                                                                                                                • Part of subcall function 00007FF7682C1768: VirtualQuery.KERNEL32 ref: 00007FF7682C178F
                                                                                                                                                                                              • lstrcmpiW.KERNELBASE(?,?,?,00007FF7682C4397,?,?,?,?,00007FF7682C1031), ref: 00007FF7682C41A4
                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(?,?,?,?,00007FF7682C1031), ref: 00007FF7682C4278
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CriticalExtensionInitializePathQueryRemoveSectionVirtuallstrcmpi
                                                                                                                                                                                              • String ID: BraveUpdate.ini$SystemDrive
                                                                                                                                                                                              • API String ID: 4116145752-4063966519
                                                                                                                                                                                              • Opcode ID: 585b218e4b01064a166878589254a93d65b6c1fbbbc0224284a16055a9a10c7f
                                                                                                                                                                                              • Instruction ID: 27133ae1f4328cc88849346a9db9db3629c128f05b4cc6cbb08dba739d067d17
                                                                                                                                                                                              • Opcode Fuzzy Hash: 585b218e4b01064a166878589254a93d65b6c1fbbbc0224284a16055a9a10c7f
                                                                                                                                                                                              • Instruction Fuzzy Hash: 4D719361A18B42C5EB40FB29D845279E3A0FF84BA8FC44232EA5D437E5DF2CD545CB68
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C4F20 Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: __scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2303962521-0
                                                                                                                                                                                              • Opcode ID: 932f7c441bc12c5655ae164f97e963ba30f4104fa42af6b90cedcf4448ca8a13
                                                                                                                                                                                              • Instruction ID: 8b866f7e3cc84b83f1ea8704738d0211e264e7a13ec7cbc248ab91bdba61d895
                                                                                                                                                                                              • Opcode Fuzzy Hash: 932f7c441bc12c5655ae164f97e963ba30f4104fa42af6b90cedcf4448ca8a13
                                                                                                                                                                                              • Instruction Fuzzy Hash: 1E314A21E0C102CDFAA4BB6496613BAD6D1AF4578CFC40035E94D4B2D7DE6DE4048ABD
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C4DC4 Relevance: 6.1, APIs: 4, Instructions: 91COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(?,?,?,00007FF7682C1324,?,?,?,00007FF7682C1B30,?,?,?,00007FF7682C3E07), ref: 00007FF7682C4DE2
                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(?,?,?,00007FF7682C1324,?,?,?,00007FF7682C1B30,?,?,?,00007FF7682C3E07), ref: 00007FF7682C4E00
                                                                                                                                                                                              • _set_fmode.LIBCMT ref: 00007FF7682C4E53
                                                                                                                                                                                              • _RTC_Initialize.LIBCMT ref: 00007FF7682C4E74
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CriticalSection$EnterInitializeLeave_set_fmode
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2803588085-0
                                                                                                                                                                                              • Opcode ID: d360118b941598006fcc0d9ac8a46f19a7c40f0d64593e72a7869be7fa6dc370
                                                                                                                                                                                              • Instruction ID: 4a32994943b4c76fd2a0e4830c5b59e362a659e2f74e1513fe9eec86e77af335
                                                                                                                                                                                              • Opcode Fuzzy Hash: d360118b941598006fcc0d9ac8a46f19a7c40f0d64593e72a7869be7fa6dc370
                                                                                                                                                                                              • Instruction Fuzzy Hash: A2316F11E08643CEFBE47BB1A9421BAD2A0AF84758FC40475EA4D076C7DE2CF4918E79
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C4230 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 140COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(?,?,?,?,00007FF7682C1031), ref: 00007FF7682C4278
                                                                                                                                                                                                • Part of subcall function 00007FF7682C147C: GetProcessHeap.KERNEL32 ref: 00007FF7682C14F2
                                                                                                                                                                                                • Part of subcall function 00007FF7682C147C: _Init_thread_footer.LIBCMT ref: 00007FF7682C1527
                                                                                                                                                                                                • Part of subcall function 00007FF7682C147C: _Init_thread_footer.LIBCMT ref: 00007FF7682C1590
                                                                                                                                                                                                • Part of subcall function 00007FF7682C3ACC: GetEnvironmentVariableW.KERNEL32(?,?,?,00007FF7682C42C9,?,?,?,?,00007FF7682C1031), ref: 00007FF7682C3B0E
                                                                                                                                                                                                • Part of subcall function 00007FF7682C3ACC: GetEnvironmentVariableW.KERNEL32(?,?,?,00007FF7682C42C9,?,?,?,?,00007FF7682C1031), ref: 00007FF7682C3B46
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: EnvironmentInit_thread_footerVariable$CriticalHeapInitializeProcessSection
                                                                                                                                                                                              • String ID: BraveUpdate.ini$SystemDrive
                                                                                                                                                                                              • API String ID: 3489650459-4063966519
                                                                                                                                                                                              • Opcode ID: 782f436498ff015fde4b1bd4292e48b90e57d713d0d7b6be53d8b12ac70cae73
                                                                                                                                                                                              • Instruction ID: 51b86bd9c5e49af697b4989ff3ef477f7115036f6039d6c0383e8d9834d15ba1
                                                                                                                                                                                              • Opcode Fuzzy Hash: 782f436498ff015fde4b1bd4292e48b90e57d713d0d7b6be53d8b12ac70cae73
                                                                                                                                                                                              • Instruction Fuzzy Hash: 0B617D21A18B46C9EB44FB24D8852B9E3A0FF80758FD04236D66D036E5DF6CE554CB68
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682D305C Relevance: 4.6, APIs: 3, Instructions: 78COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,00007FF7682CC913), ref: 00007FF7682D3075
                                                                                                                                                                                              • FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7682CC913), ref: 00007FF7682D30E7
                                                                                                                                                                                                • Part of subcall function 00007FF7682D0E10: HeapAlloc.KERNEL32(?,?,?,00007FF7682D1471,?,?,00000000,00007FF7682CBF83,?,?,?,00007FF7682CD21B,?,?,?,00007FF7682CD111), ref: 00007FF7682D0E4E
                                                                                                                                                                                              • FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7682CC913), ref: 00007FF7682D3146
                                                                                                                                                                                                • Part of subcall function 00007FF7682D07E4: HeapFree.KERNEL32(?,?,?,00007FF7682D367E,?,?,?,00007FF7682D36BB,?,?,00000000,00007FF7682D3B8C,?,?,?,00007FF7682D3ABF), ref: 00007FF7682D07FA
                                                                                                                                                                                                • Part of subcall function 00007FF7682D07E4: GetLastError.KERNEL32(?,?,?,00007FF7682D367E,?,?,?,00007FF7682D36BB,?,?,00000000,00007FF7682D3B8C,?,?,?,00007FF7682D3ABF), ref: 00007FF7682D0804
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: EnvironmentFreeStrings$Heap$AllocErrorLast
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3331406755-0
                                                                                                                                                                                              • Opcode ID: 1f0da76c56bf5a8e8a47d44f051a250c4cd72ab714efc09f342b703069ac0a13
                                                                                                                                                                                              • Instruction ID: 14d03a9ff7d304365226988e8a9cab02ca7593a022c6899eedbd60c517b09c8a
                                                                                                                                                                                              • Opcode Fuzzy Hash: 1f0da76c56bf5a8e8a47d44f051a250c4cd72ab714efc09f342b703069ac0a13
                                                                                                                                                                                              • Instruction Fuzzy Hash: 8E31B523B18752C9E624BF21A44426AFAE0BF54BD8F884135EA4E477D5EF3CE4518618
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682CCE04 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                              • Opcode ID: 56bc4b33e30ecd438373de69222ac63f6b51fdce199bb6f9000f6194c878a1e3
                                                                                                                                                                                              • Instruction ID: 01fbaca4437380fa6f99e026cc16fed6fe8145205f0e35bb8f7b662a2d1511f2
                                                                                                                                                                                              • Opcode Fuzzy Hash: 56bc4b33e30ecd438373de69222ac63f6b51fdce199bb6f9000f6194c878a1e3
                                                                                                                                                                                              • Instruction Fuzzy Hash: 37D09E15F18606CAEA943F705869278D6516F49F09FC4243CD81F06393CD2CE419C728
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C2568 Relevance: 3.2, APIs: 2, Instructions: 240COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 386 7ff7682c2568-7ff7682c25a0 call 7ff7682c1aec call 7ff7682c2be4 391 7ff7682c25e2-7ff7682c25fa CommandLineToArgvW 386->391 392 7ff7682c25a2-7ff7682c25ce call 7ff7682c17a8 call 7ff7682c2f40 386->392 393 7ff7682c2608-7ff7682c260e 391->393 394 7ff7682c25fc-7ff7682c2603 call 7ff7682c39c0 391->394 410 7ff7682c25d0-7ff7682c25d3 392->410 411 7ff7682c25d9-7ff7682c25dd call 7ff7682c3f80 392->411 397 7ff7682c2856 393->397 398 7ff7682c2614-7ff7682c2666 call 7ff7682c32f4 * 2 393->398 404 7ff7682c2864-7ff7682c2879 394->404 402 7ff7682c285b-7ff7682c285e LocalFree 397->402 414 7ff7682c266f-7ff7682c267a call 7ff7682c147c 398->414 415 7ff7682c2668-7ff7682c266a 398->415 402->404 408 7ff7682c2884-7ff7682c289d 404->408 409 7ff7682c287b-7ff7682c287e 404->409 409->408 410->411 411->391 418 7ff7682c2680-7ff7682c2695 414->418 419 7ff7682c289e-7ff7682c28ab call 7ff7682c1230 414->419 415->402 423 7ff7682c27d2-7ff7682c27e7 418->423 424 7ff7682c269b 418->424 423->415 426 7ff7682c27ed-7ff7682c27f6 423->426 425 7ff7682c26a0-7ff7682c26c5 call 7ff7682c1aec call 7ff7682c2be4 call 7ff7682c28ac 424->425 434 7ff7682c26f8-7ff7682c26ff call 7ff7682c2904 425->434 435 7ff7682c26c7-7ff7682c26d4 call 7ff7682c2998 425->435 426->415 440 7ff7682c2701-7ff7682c270c call 7ff7682c2904 434->440 441 7ff7682c2780-7ff7682c279e call 7ff7682c22e8 434->441 442 7ff7682c26da-7ff7682c26ea call 7ff7682c2208 435->442 443 7ff7682c27fb 435->443 457 7ff7682c2712-7ff7682c2751 call 7ff7682c2b4c call 7ff7682c2998 440->457 458 7ff7682c2841-7ff7682c2846 440->458 455 7ff7682c27a4-7ff7682c27b7 441->455 456 7ff7682c2848-7ff7682c2854 441->456 442->443 452 7ff7682c26f0-7ff7682c26f3 442->452 444 7ff7682c27ff-7ff7682c2803 443->444 448 7ff7682c2807-7ff7682c2814 444->448 453 7ff7682c281f-7ff7682c2834 448->453 454 7ff7682c2816-7ff7682c2819 448->454 452->455 453->402 459 7ff7682c2836-7ff7682c283f 453->459 454->453 460 7ff7682c27c2-7ff7682c27c8 455->460 461 7ff7682c27b9-7ff7682c27bc 455->461 456->448 468 7ff7682c2753-7ff7682c2756 457->468 469 7ff7682c275c-7ff7682c275e 457->469 458->443 459->402 460->425 464 7ff7682c27ce 460->464 461->460 464->423 468->469 469->444 470 7ff7682c2764-7ff7682c2775 call 7ff7682c2208 469->470 470->444 473 7ff7682c277b-7ff7682c277e 470->473 473->455
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • CommandLineToArgvW.SHELL32 ref: 00007FF7682C25EE
                                                                                                                                                                                                • Part of subcall function 00007FF7682C17A8: GetModuleFileNameW.KERNEL32(?,?,?,00007FF7682C18AF,?,?,?,00007FF7682C1900,?,?,?,00007FF7682C4166,?,?,?,00007FF7682C4397), ref: 00007FF7682C181F
                                                                                                                                                                                              • LocalFree.KERNEL32 ref: 00007FF7682C285E
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ArgvCommandFileFreeLineLocalModuleName
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 871553864-0
                                                                                                                                                                                              • Opcode ID: 261da83bd29409bd290db27cab7d63d5a5ad6b057b273507a5cc131b31ec904b
                                                                                                                                                                                              • Instruction ID: 11e021061921363ad9ae2d5f5f1874492a1fb615224e65f2187900a5c09d2083
                                                                                                                                                                                              • Opcode Fuzzy Hash: 261da83bd29409bd290db27cab7d63d5a5ad6b057b273507a5cc131b31ec904b
                                                                                                                                                                                              • Instruction Fuzzy Hash: 23A192A2B04A42CAEB40AF69C8402BDE761FF48BBCB805231DA2D577D5DF78D845C764
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682CCD35 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3947729631-0
                                                                                                                                                                                              • Opcode ID: ab5672b8206b1259b8ff5942ab4e8ee7d0982f89718f223ccbdc1d18da8d6cb8
                                                                                                                                                                                              • Instruction ID: 2d5dcecff3159c9348dc1aaea8cfb32fdb7ad0778ff8b6b35f8a96be29bcc563
                                                                                                                                                                                              • Opcode Fuzzy Hash: ab5672b8206b1259b8ff5942ab4e8ee7d0982f89718f223ccbdc1d18da8d6cb8
                                                                                                                                                                                              • Instruction Fuzzy Hash: 16217C72A14B05CDEBA4AF64D4802BCB7B0EB44B1CF840636D61D06A89DF38D486CB94
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C4A6C Relevance: 1.5, APIs: 1, Instructions: 15registryCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 519 7ff7682c4a6c-7ff7682c4a83 RegOverridePredefKey 520 7ff7682c4a85-7ff7682c4a92 519->520 521 7ff7682c4a94 519->521 522 7ff7682c4a96-7ff7682c4a9a 520->522 521->522
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: OverridePredef
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 898253552-0
                                                                                                                                                                                              • Opcode ID: a54fe31a83ffca700cab3f2df1340a5a0451b92f8e500fe702df7ff68e3a2b60
                                                                                                                                                                                              • Instruction ID: e1707eb3151d6036050970719385a45b396c2224177fc364c6526b4cd29ad350
                                                                                                                                                                                              • Opcode Fuzzy Hash: a54fe31a83ffca700cab3f2df1340a5a0451b92f8e500fe702df7ff68e3a2b60
                                                                                                                                                                                              • Instruction Fuzzy Hash: F9D0C920B2A953C9EB98B2371C60377D1C16F94776FE04638D96EC02E4ED1CD455952D
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                              Function 00007FF7682C498C Relevance: 13.5, APIs: 9, Instructions: 42clipboardmemorystringCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ClipboardGlobal$AllocCloseDataEmptyFreeLockOpenUnlocklstrlen
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2633044538-0
                                                                                                                                                                                              • Opcode ID: 6352fce9b027cbcad951bd88884d2899684f12d3dcad91e103972fcb2fd759b9
                                                                                                                                                                                              • Instruction ID: c45c74d1a6a4b9ab3c7f7325a386d648cebb70d3d410cc683dab52b275be815c
                                                                                                                                                                                              • Opcode Fuzzy Hash: 6352fce9b027cbcad951bd88884d2899684f12d3dcad91e103972fcb2fd759b9
                                                                                                                                                                                              • Instruction Fuzzy Hash: 71018822B0D742CAFA547B61B858239E7D5AF44FC9F844039E90E07798DE3CD454C728
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C5994 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3140674995-0
                                                                                                                                                                                              • Opcode ID: 856f282e32df8d73fe04972479197951aa21ac118391512de7235e9480e850fc
                                                                                                                                                                                              • Instruction ID: 0e52c747a981413c20dc39e5d3a20e4fa7ee6245aa67ee543b7b5694c794f6a6
                                                                                                                                                                                              • Opcode Fuzzy Hash: 856f282e32df8d73fe04972479197951aa21ac118391512de7235e9480e850fc
                                                                                                                                                                                              • Instruction Fuzzy Hash: 58311072609B81C9EBA09F61E8543FDF7A4FB44748F84403ADA4D47A94DF38D558C714
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682CB4C8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1239891234-0
                                                                                                                                                                                              • Opcode ID: 1f21c73235f27cd65a3ae5271448de8eacf63756b009dbb338a66ae7eacb1eeb
                                                                                                                                                                                              • Instruction ID: 42440fe46e23e9d0917d9bfd8d93980a52767a52d85baa603d715ef77392f698
                                                                                                                                                                                              • Opcode Fuzzy Hash: 1f21c73235f27cd65a3ae5271448de8eacf63756b009dbb338a66ae7eacb1eeb
                                                                                                                                                                                              • Instruction Fuzzy Hash: 0E315E32608B81CADB609B25E8542BEF7A0FF88798F900136EA8D43B64DF3CC155CB14
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C4CE8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7682C4D6B
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                                                                                                                              • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                              • API String ID: 450123788-631824599
                                                                                                                                                                                              • Opcode ID: 6d4ae9a61894bf9dc68d31e19d5d557322089d6c62bf4dfdcca0423adfd2fa08
                                                                                                                                                                                              • Instruction ID: e27bae355b6da1f98c1de8105a73c5b055a65714337cd8bf8f07c12b9dfd2fdc
                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d4ae9a61894bf9dc68d31e19d5d557322089d6c62bf4dfdcca0423adfd2fa08
                                                                                                                                                                                              • Instruction Fuzzy Hash: 3C114F32A14B42DAE794AB22D5953B9F2E4FF44348F805135D64D82A50EF3CE0B4CB64
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C5300 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                                              • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                                              • API String ID: 2565136772-3242537097
                                                                                                                                                                                              • Opcode ID: d0932d7c438688d582f413cb499b0fb58ae1f7555594c2062416a4d41a1e6a08
                                                                                                                                                                                              • Instruction ID: cfa8e6a9024793f8ff56cd5c05c2eb6fdb40092926959fffec1615c51515d658
                                                                                                                                                                                              • Opcode Fuzzy Hash: d0932d7c438688d582f413cb499b0fb58ae1f7555594c2062416a4d41a1e6a08
                                                                                                                                                                                              • Instruction Fuzzy Hash: E8211D21A19B03C9FA55BB10E9642B8E7E0BF44749FC84036D80E066A5DF7CE464C728
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C889C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 312COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Frame$BlockEstablisherHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                              • API String ID: 3606184308-393685449
                                                                                                                                                                                              • Opcode ID: 63ad03cd6e2f7ec02ae8b206012f5976f2b919b313892ef082b4d9b74bb7d58a
                                                                                                                                                                                              • Instruction ID: dcc294d63ffec5e9d3915c440620d823fea54306026054be11f1405ee1e60a06
                                                                                                                                                                                              • Opcode Fuzzy Hash: 63ad03cd6e2f7ec02ae8b206012f5976f2b919b313892ef082b4d9b74bb7d58a
                                                                                                                                                                                              • Instruction Fuzzy Hash: 61D16A62A08B41CEEBA0AB6594402BDFBA0FF5578CF804135DE4D57B55CF38E181CB18
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682CAFBC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7682CB26E,?,?,?,00007FF7682C7F1C,?,?,?,?,00007FF7682C6CE5), ref: 00007FF7682CB041
                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7682CB26E,?,?,?,00007FF7682C7F1C,?,?,?,?,00007FF7682C6CE5), ref: 00007FF7682CB04F
                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7682CB26E,?,?,?,00007FF7682C7F1C,?,?,?,?,00007FF7682C6CE5), ref: 00007FF7682CB079
                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF7682CB26E,?,?,?,00007FF7682C7F1C,?,?,?,?,00007FF7682C6CE5), ref: 00007FF7682CB0BF
                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF7682CB26E,?,?,?,00007FF7682C7F1C,?,?,?,?,00007FF7682C6CE5), ref: 00007FF7682CB0CB
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                              • API String ID: 2559590344-2084034818
                                                                                                                                                                                              • Opcode ID: 7bd561f589a816d7365c8a20ee621460f0e822f29d8152b4ff3ebf9f1da5536b
                                                                                                                                                                                              • Instruction ID: 63bbe7bfbb430e8851dc6845871d4764c66f3dac901fac40414361f03ef28a45
                                                                                                                                                                                              • Opcode Fuzzy Hash: 7bd561f589a816d7365c8a20ee621460f0e822f29d8152b4ff3ebf9f1da5536b
                                                                                                                                                                                              • Instruction Fuzzy Hash: FA310822B1AA82D9EE51FB02A400675E7D4FF08BA8F994534DD2D17780DF3CE440CB69
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C4878 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64windowCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExitMessageProcesswsprintf
                                                                                                                                                                                              • String ID: Exception$Exception %x in %s %s %u%hs:%d$base\logging.cc
                                                                                                                                                                                              • API String ID: 1070390611-1730742759
                                                                                                                                                                                              • Opcode ID: 7bc731f639765bbc45b412fa4d5d969e96db5bb59056e3641ba6b012cfbdfdd4
                                                                                                                                                                                              • Instruction ID: 11e75866add4e0f832c05d9895ae11143f85de8ee704180c7b0f669425bf3337
                                                                                                                                                                                              • Opcode Fuzzy Hash: 7bc731f639765bbc45b412fa4d5d969e96db5bb59056e3641ba6b012cfbdfdd4
                                                                                                                                                                                              • Instruction Fuzzy Hash: 9C31E832A18A42C5E790EB25E4442BAF3A0FF84768F904232EA5D436D4CF7CD454CB58
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682D0484 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                              • Opcode ID: d8e72a46659b588cf39cda77bb3e9e8aa995441e9d1e78c2199d43223b5a092a
                                                                                                                                                                                              • Instruction ID: c2da0088ba3d7d7ccf8b5a92c77209660e777d9ea58daba3c6b7b9b3bf39f128
                                                                                                                                                                                              • Opcode Fuzzy Hash: d8e72a46659b588cf39cda77bb3e9e8aa995441e9d1e78c2199d43223b5a092a
                                                                                                                                                                                              • Instruction Fuzzy Hash: DC218022F0D243C9F9547321655963DE9416F487B8FD04739E97E0B7E6DE2CE401862C
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682D7570 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                              • String ID: CONOUT$
                                                                                                                                                                                              • API String ID: 3230265001-3130406586
                                                                                                                                                                                              • Opcode ID: 6744946ae0f340affcf5deff357b5612c7dd714733c0c5371dfc196223539289
                                                                                                                                                                                              • Instruction ID: b0e0e98fc5951de0949d0fb178b63a78f6670febc7c474907c4ef6269229d4f1
                                                                                                                                                                                              • Opcode Fuzzy Hash: 6744946ae0f340affcf5deff357b5612c7dd714733c0c5371dfc196223539289
                                                                                                                                                                                              • Instruction Fuzzy Hash: FA118472A18A41CAE750AB16E868329F6E0FF48BE8F404235ED5D47794DF3CD4548758
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C8D64 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 316COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                              • API String ID: 3523768491-393685449
                                                                                                                                                                                              • Opcode ID: 98ef0cd0e680e3c110ec02bab273df96654672f66f20bd4e239d75981e65934a
                                                                                                                                                                                              • Instruction ID: ae4c973bca1d63a08d2d0c87c4f16cbfc430cbe45a9d21dee50a5bf427186c4a
                                                                                                                                                                                              • Opcode Fuzzy Hash: 98ef0cd0e680e3c110ec02bab273df96654672f66f20bd4e239d75981e65934a
                                                                                                                                                                                              • Instruction Fuzzy Hash: F9E18C72A08682CEE790AB25D4802BDF7B0FF4474CF944136DA8D47696DF38E585CB64
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682D05FC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000004,00007FF7682CB90D,?,?,?,?,00007FF7682D148A,?,?,00000000,00007FF7682CBF83,?,?,?), ref: 00007FF7682D060B
                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,00000004,00007FF7682CB90D,?,?,?,?,00007FF7682D148A,?,?,00000000,00007FF7682CBF83,?,?,?), ref: 00007FF7682D0641
                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,00000004,00007FF7682CB90D,?,?,?,?,00007FF7682D148A,?,?,00000000,00007FF7682CBF83,?,?,?), ref: 00007FF7682D066E
                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,00000004,00007FF7682CB90D,?,?,?,?,00007FF7682D148A,?,?,00000000,00007FF7682CBF83,?,?,?), ref: 00007FF7682D067F
                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,00000004,00007FF7682CB90D,?,?,?,?,00007FF7682D148A,?,?,00000000,00007FF7682CBF83,?,?,?), ref: 00007FF7682D0690
                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,00000004,00007FF7682CB90D,?,?,?,?,00007FF7682D148A,?,?,00000000,00007FF7682CBF83,?,?,?), ref: 00007FF7682D06AB
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                              • Opcode ID: d283a5757241d0db6c9e4e54c7904e822944ea40952372f0f7c9e378318b67ee
                                                                                                                                                                                              • Instruction ID: 26da4004cba3f951f282c15794aa34d467e39420b148b1fb1c9a5bd7d59a3949
                                                                                                                                                                                              • Opcode Fuzzy Hash: d283a5757241d0db6c9e4e54c7904e822944ea40952372f0f7c9e378318b67ee
                                                                                                                                                                                              • Instruction Fuzzy Hash: 6511C322F0D203C9F914B3216555239E9825F887B8FD40736E97E0A7E6DE2CF401866C
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682CCE68 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                              • Opcode ID: 8fa0014bd8cc9ad319b709363effa9625d4e159ced705655add725fefc1abf70
                                                                                                                                                                                              • Instruction ID: 95bb4caf857f2f0fac9d595c1c88d14e9def221292ef27841610bee6f46c667c
                                                                                                                                                                                              • Opcode Fuzzy Hash: 8fa0014bd8cc9ad319b709363effa9625d4e159ced705655add725fefc1abf70
                                                                                                                                                                                              • Instruction Fuzzy Hash: E0F06223B09A06C5EB50AB24E46837AD760AF49B69FD40635D56E456E4CF3CD049C724
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C816C Relevance: 7.8, APIs: 5, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AdjustPointer
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1740715915-0
                                                                                                                                                                                              • Opcode ID: 4d00dfa98fef6639e7e0ed4c46e33340039de891f782c981ddb46dfd6b298acb
                                                                                                                                                                                              • Instruction ID: 871c391378b5fea2f3064ef236cf309616829399cee3da1e07102ae44599f70a
                                                                                                                                                                                              • Opcode Fuzzy Hash: 4d00dfa98fef6639e7e0ed4c46e33340039de891f782c981ddb46dfd6b298acb
                                                                                                                                                                                              • Instruction Fuzzy Hash: 65B1A222A49A82CDEAE5FB159440279E2A0EF44BCCF89C436DE4D07785DF7CE441CB69
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682D6488 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: _set_statfp
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1156100317-0
                                                                                                                                                                                              • Opcode ID: 873ddd27d6e11e6a5cebdd6bc92ecbbe564fd9246daab4c3561fdf3265e0169f
                                                                                                                                                                                              • Instruction ID: b6f269f411d11283755de6fee0516f4c09aaee56065398c11fcc3d4ad441420f
                                                                                                                                                                                              • Opcode Fuzzy Hash: 873ddd27d6e11e6a5cebdd6bc92ecbbe564fd9246daab4c3561fdf3265e0169f
                                                                                                                                                                                              • Instruction Fuzzy Hash: 2E114F23E58A138DF7643168E495379F8416F543BCE984634EB6E166DF8E1CA8C141A8
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682D06C4 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF7682CB457,?,?,00000000,00007FF7682CB6F2,?,?,?,?,?,00007FF7682CB67E), ref: 00007FF7682D06E3
                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7682CB457,?,?,00000000,00007FF7682CB6F2,?,?,?,?,?,00007FF7682CB67E), ref: 00007FF7682D0702
                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7682CB457,?,?,00000000,00007FF7682CB6F2,?,?,?,?,?,00007FF7682CB67E), ref: 00007FF7682D072A
                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7682CB457,?,?,00000000,00007FF7682CB6F2,?,?,?,?,?,00007FF7682CB67E), ref: 00007FF7682D073B
                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7682CB457,?,?,00000000,00007FF7682CB6F2,?,?,?,?,?,00007FF7682CB67E), ref: 00007FF7682D074C
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                              • Opcode ID: 74bb74b2db03be599dc3f582c05d3f9ac791ac09bdefcdf8192293cb6947a932
                                                                                                                                                                                              • Instruction ID: 90c6da40d69769a1ea7d95128740ffecd3222e1e0a12ae2be4b5a1b4ca9bdaf1
                                                                                                                                                                                              • Opcode Fuzzy Hash: 74bb74b2db03be599dc3f582c05d3f9ac791ac09bdefcdf8192293cb6947a932
                                                                                                                                                                                              • Instruction Fuzzy Hash: 32118122F09243C9FA98B3216545279E9415F947B8FD44336D97E0E7F6DE2CF4018A2C
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682D0558 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                              • Opcode ID: 4003d399602fdb2e6d86e11bf2af7f7abd5e5b8b2c83d9ce013488e70bb0eb2e
                                                                                                                                                                                              • Instruction ID: f5e3d1dc0de365ee94f22fd516f5c25c9c417aaaaaddb493118ffdded7da0ef1
                                                                                                                                                                                              • Opcode Fuzzy Hash: 4003d399602fdb2e6d86e11bf2af7f7abd5e5b8b2c83d9ce013488e70bb0eb2e
                                                                                                                                                                                              • Instruction Fuzzy Hash: 21111552E09207CEF968B2215455679D9416F4832CFD8073AE93E0A3E2DD3CB4519A3C
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C47FC Relevance: 7.5, APIs: 5, Instructions: 30sleepCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CountCriticalEnterSectionTick$Sleep
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1544504822-0
                                                                                                                                                                                              • Opcode ID: d7e02f4f289bb2db9ce91d24be9f87c42b2c0c2816f87d5be78a77ea46c855c7
                                                                                                                                                                                              • Instruction ID: 527eac3ced3b2191665fa6603d83647030e83a2ae38df1f43a5a9debd073d16c
                                                                                                                                                                                              • Opcode Fuzzy Hash: d7e02f4f289bb2db9ce91d24be9f87c42b2c0c2816f87d5be78a77ea46c855c7
                                                                                                                                                                                              • Instruction Fuzzy Hash: 08F09622A0C642C6EB60AF36A95817EEBA0EF44F88F846134E90E53754CF3CD455D724
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C9478 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                                                                                              • Opcode ID: bd8805524c5a518b6ed0574f6bbf057b163164750cdbc9cf4d6aba664b08fdbe
                                                                                                                                                                                              • Instruction ID: 324785ed3187fa51eb38f6fa38264e9a4b7196b83ef8a609979622c944f23c34
                                                                                                                                                                                              • Opcode Fuzzy Hash: bd8805524c5a518b6ed0574f6bbf057b163164750cdbc9cf4d6aba664b08fdbe
                                                                                                                                                                                              • Instruction Fuzzy Hash: 0C918D73A08781CEE791AB65D8402ACFBA0FB0578CF50412AEA4D17795DF38D1A5CB14
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C9260 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                                                                                              • Opcode ID: 3986aabe1b196e0b104032cc063a00ef737c05c6121aed79900c35d09936af6f
                                                                                                                                                                                              • Instruction ID: 3c3647ff250a621ec26cde30e305b8fc51f05d41ee2055ba39bb63c47fc58404
                                                                                                                                                                                              • Opcode Fuzzy Hash: 3986aabe1b196e0b104032cc063a00ef737c05c6121aed79900c35d09936af6f
                                                                                                                                                                                              • Instruction Fuzzy Hash: D9515732A08A85CAEB60AF65D4803BDB7A0FB44B8CF544125EF4D17B99DF38E065CB54
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C99EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                              • String ID: csm$csm
                                                                                                                                                                                              • API String ID: 3896166516-3733052814
                                                                                                                                                                                              • Opcode ID: 0f8f5fb4e70161e309bd5a81c68fe3d6567cfab9e73e95d24dbab63c632372ed
                                                                                                                                                                                              • Instruction ID: 2afb6fa4d92ad82b231c4fc351274a2fa448297cda511b7d83cd1e3457dcaa24
                                                                                                                                                                                              • Opcode Fuzzy Hash: 0f8f5fb4e70161e309bd5a81c68fe3d6567cfab9e73e95d24dbab63c632372ed
                                                                                                                                                                                              • Instruction Fuzzy Hash: CE516A72908682CAEBA4AB159484378FAA0FF54B8CF944135DA8D47BD5CF3CE561CF18
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682D57CC Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2718003287-0
                                                                                                                                                                                              • Opcode ID: 334b0dc948d47d320824f20400e88d6d2d48d26f659673be3289c893357f7756
                                                                                                                                                                                              • Instruction ID: 3a47795b7f03a3620239dcc6c9ebacdde4438d5febcfd71acabc8790053ea885
                                                                                                                                                                                              • Opcode Fuzzy Hash: 334b0dc948d47d320824f20400e88d6d2d48d26f659673be3289c893357f7756
                                                                                                                                                                                              • Instruction Fuzzy Hash: D0D1DA23B08A81CEE711DF79D5402ACBBA1FB44B9CB948232CE5D97B99DE38D406C714
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682D6110 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7682D60B0), ref: 00007FF7682D6233
                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7682D60B0), ref: 00007FF7682D62BD
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ConsoleErrorLastMode
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 953036326-0
                                                                                                                                                                                              • Opcode ID: a9dd361a0254576237120e279956d1ce34bb011b59d6446f3e8426c812783fdc
                                                                                                                                                                                              • Instruction ID: 1b7954016f68886d5dc410d05e5391d07bd509f9dcf1fdd5a0f79e470a96fd77
                                                                                                                                                                                              • Opcode Fuzzy Hash: a9dd361a0254576237120e279956d1ce34bb011b59d6446f3e8426c812783fdc
                                                                                                                                                                                              • Instruction Fuzzy Hash: 6991DD23E18652CDEB60ABA594843BDFBA0BF04B9CF805136DE0E13695CF38E445C768
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C9C24 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: __except_validate_context_record
                                                                                                                                                                                              • String ID: csm$csm
                                                                                                                                                                                              • API String ID: 1467352782-3733052814
                                                                                                                                                                                              • Opcode ID: 29fdda5b30725ca6b69e625fd7ee3d9daa1a4574c6ce4e214ef274418a096f78
                                                                                                                                                                                              • Instruction ID: cf83752b7058833a517a38abf8eb626f70675c54190c689afa74077378533314
                                                                                                                                                                                              • Opcode Fuzzy Hash: 29fdda5b30725ca6b69e625fd7ee3d9daa1a4574c6ce4e214ef274418a096f78
                                                                                                                                                                                              • Instruction Fuzzy Hash: FF719032A08681CED7A0AF25945077DFBA0EF14B8DF848136DA4C47B85CB3CD5A0CB59
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682CA254 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CreateFrameInfo__except_validate_context_record
                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                              • API String ID: 2558813199-1018135373
                                                                                                                                                                                              • Opcode ID: e0e163a061f5fd86d3b0bc4f115189f4d0de6791220c887537f2f0b5cbdb6146
                                                                                                                                                                                              • Instruction ID: ca6793cf171f612bd31f91a80f482f7d0de69b71792000c83c08ef7b09b85235
                                                                                                                                                                                              • Opcode Fuzzy Hash: e0e163a061f5fd86d3b0bc4f115189f4d0de6791220c887537f2f0b5cbdb6146
                                                                                                                                                                                              • Instruction Fuzzy Hash: 57514C72618741CADAA0AB19E4402BEF7B4FB88B94F540135EB9D07B55CF38E461CF58
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682D5E78 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                                                                                              • String ID: U
                                                                                                                                                                                              • API String ID: 442123175-4171548499
                                                                                                                                                                                              • Opcode ID: 6be6829359151198edfbd10a6266738ccd4cda3533b7bd1e921c6017fea42fc2
                                                                                                                                                                                              • Instruction ID: 544e6770bcc0dd1eef053cddbe33ceb83d5434adecfdc72ff6276e777b2935c9
                                                                                                                                                                                              • Opcode Fuzzy Hash: 6be6829359151198edfbd10a6266738ccd4cda3533b7bd1e921c6017fea42fc2
                                                                                                                                                                                              • Instruction Fuzzy Hash: 3141A023A18A41CADB20AF25E4443A9FBA1FF88798F804131EE4D87798EF7CD441CB54
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682D78E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • __C_specific_handler.LIBVCRUNTIME ref: 00007FF7682D78F8
                                                                                                                                                                                                • Part of subcall function 00007FF7682C6AA8: __except_validate_context_record.LIBVCRUNTIME ref: 00007FF7682C6AD3
                                                                                                                                                                                                • Part of subcall function 00007FF7682C6AA8: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7682C6B68
                                                                                                                                                                                                • Part of subcall function 00007FF7682C6AA8: RtlUnwindEx.KERNEL32 ref: 00007FF7682C6BB7
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: C_specific_handlerCurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                              • String ID: csm$f
                                                                                                                                                                                              • API String ID: 3112662972-629598281
                                                                                                                                                                                              • Opcode ID: 75fe812e090a62ea16aaf9a07a0bae683ccfdb612d7947684b0b506522d6098b
                                                                                                                                                                                              • Instruction ID: 4b9c839728f1e65581f27d462dab79f6a57d54e399cf5fb236a0081a0fa53f38
                                                                                                                                                                                              • Opcode Fuzzy Hash: 75fe812e090a62ea16aaf9a07a0bae683ccfdb612d7947684b0b506522d6098b
                                                                                                                                                                                              • Instruction Fuzzy Hash: DFF0A723808242CCDA543B25B0803FCEAB0BF45748F948434DE5C07386CF3DD4A08628
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF7682C7BFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7682C60BE), ref: 00007FF7682C7C40
                                                                                                                                                                                              • RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7682C60BE), ref: 00007FF7682C7C86
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 00000004.00000002.1686438246.00007FF7682C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7682C0000, based on PE: true
                                                                                                                                                                                              • Associated: 00000004.00000002.1686407026.00007FF7682C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686467660.00007FF7682D9000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686494713.00007FF7682E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              • Associated: 00000004.00000002.1686519285.00007FF7682ED000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_7ff7682c0000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                              • API String ID: 2573137834-1018135373
                                                                                                                                                                                              • Opcode ID: 03777b1816255e2506ae4b714f773a70b19ae6a9c3f00a805364dd9ab622737b
                                                                                                                                                                                              • Instruction ID: 56500c6278053273ab3756f938785d0cbc4a8c71b4911aaaa9853c74f4e06448
                                                                                                                                                                                              • Opcode Fuzzy Hash: 03777b1816255e2506ae4b714f773a70b19ae6a9c3f00a805364dd9ab622737b
                                                                                                                                                                                              • Instruction Fuzzy Hash: A4118C32608B8286EBA09F15E440269FBE1FF88B88F984230EE8C07754DF3CD551CB14
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                              Function 00C51152 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 99processCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                                • Part of subcall function 00C51000: GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories,00C5116C), ref: 00C5100A
                                                                                                                                                                                                • Part of subcall function 00C51000: GetProcAddress.KERNEL32(00000000), ref: 00C51011
                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000207), ref: 00C5119B
                                                                                                                                                                                              • PathRemoveFileSpecW.SHLWAPI(?), ref: 00C511BE
                                                                                                                                                                                              • PathRemoveFileSpecW.SHLWAPI(?), ref: 00C511D8
                                                                                                                                                                                              • PathAppendW.SHLWAPI(?,BraveUpdate.exe), ref: 00C511E6
                                                                                                                                                                                              • CreateProcessW.KERNELBASE(00000000,00000022,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00C51253
                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00C5126A
                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00C51272
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FileHandlePath$CloseModuleRemoveSpec$AddressAppendCreateNameProcProcess
                                                                                                                                                                                              • String ID: "$" /ondemand $BraveUpdate.exe$D
                                                                                                                                                                                              • API String ID: 1697256010-3473998726
                                                                                                                                                                                              • Opcode ID: add5a017748b693d32185fd5979cef53fde05efaa6aba40a1aaaa7b46c512798
                                                                                                                                                                                              • Instruction ID: 84f71e86c243f24dfa8f2fdcd49eecedef0894bdb9c93d0632f2e79162ef1288
                                                                                                                                                                                              • Opcode Fuzzy Hash: add5a017748b693d32185fd5979cef53fde05efaa6aba40a1aaaa7b46c512798
                                                                                                                                                                                              • Instruction Fuzzy Hash: B83184F990021CAADF209B71DC8DFDF77BCAB44342F4405A5AE05E2142E6749BC89F69
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C57F35 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 23 c57f35-c57f41 24 c57fd3-c57fd6 23->24 25 c57f46-c57f57 24->25 26 c57fdc 24->26 28 c57f64-c57f7d LoadLibraryExW 25->28 29 c57f59-c57f5c 25->29 27 c57fde-c57fe2 26->27 32 c57fe3-c57ff3 28->32 33 c57f7f-c57f88 GetLastError 28->33 30 c57f62 29->30 31 c57ffc-c57ffe 29->31 35 c57fd0 30->35 31->27 32->31 34 c57ff5-c57ff6 FreeLibrary 32->34 36 c57fc1-c57fce 33->36 37 c57f8a-c57f9c call c55708 33->37 34->31 35->24 36->35 37->36 40 c57f9e-c57fb0 call c55708 37->40 40->36 43 c57fb2-c57fbf LoadLibraryExW 40->43 43->32 43->36
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,00C58042,00C588AA,?,00000000,00000000,00000000,?,00C5819C,00000021,FlsSetValue,00C6000C,00C60014,00000000), ref: 00C57FF6
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FreeLibrary
                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                              • API String ID: 3664257935-537541572
                                                                                                                                                                                              • Opcode ID: 06ccf64d1caed49510af9648aa9e3bb50e713cda6bfb4ebd40bfcab0b748dc7f
                                                                                                                                                                                              • Instruction ID: 14c518990735cc919c1aff9cf1745d65263cfe3b83b809690cbbf7f8adb446a0
                                                                                                                                                                                              • Opcode Fuzzy Hash: 06ccf64d1caed49510af9648aa9e3bb50e713cda6bfb4ebd40bfcab0b748dc7f
                                                                                                                                                                                              • Instruction Fuzzy Hash: 88210879A09210E7CB21DBA5BC80B5E37589B45362F210320ED15A7290D770EEC9CAD8
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C54C21 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(00C54D34,?,00C54C1B,00000000,?,?,00C54D34,F2ED4559,?,00C54D34), ref: 00C54C32
                                                                                                                                                                                              • TerminateProcess.KERNEL32(00000000,?,00C54C1B,00000000,?,?,00C54D34,F2ED4559,?,00C54D34), ref: 00C54C39
                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00C54C4B
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                              • Opcode ID: 75213b3135e8b1aa6909ee72d54b86cc8142944e218cfb3cf5d431471bf1acf0
                                                                                                                                                                                              • Instruction ID: 30520634b7efb29de94e9e838f87cf6185d49ef0911ab222289c34144ddc77b6
                                                                                                                                                                                              • Opcode Fuzzy Hash: 75213b3135e8b1aa6909ee72d54b86cc8142944e218cfb3cf5d431471bf1acf0
                                                                                                                                                                                              • Instruction Fuzzy Hash: A6D09E39001208AFDF092F60DE0DB9D3F26AFC03577044450BD1956071CBB5AAD5FA54
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C58000 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 51 c58000-c58028 52 c5802e-c58030 51->52 53 c5802a-c5802c 51->53 55 c58036-c5803d call c57f35 52->55 56 c58032-c58034 52->56 54 c5807f-c58082 53->54 58 c58042-c58046 55->58 56->54 59 c58065-c5807c 58->59 60 c58048-c58056 GetProcAddress 58->60 62 c5807e 59->62 60->59 61 c58058-c58063 call c543c3 60->61 61->62 62->54
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID:
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                              • Opcode ID: 9d610ec5150d4c2bcfde5e3f41c6c8172558b7ed72edf21271111a336ebde24d
                                                                                                                                                                                              • Instruction ID: 5468c7f87daf56cc9ed97d335d95c7a2e6219811271c922a4be351ad717fa115
                                                                                                                                                                                              • Opcode Fuzzy Hash: 9d610ec5150d4c2bcfde5e3f41c6c8172558b7ed72edf21271111a336ebde24d
                                                                                                                                                                                              • Instruction Fuzzy Hash: BB01F53B2002215F9F298E6AEC40A5A3796ABC07627254120FE14EB1D8EE71C98D9694
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                              Function 00C51850 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00C5185C
                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32 ref: 00C51928
                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00C51948
                                                                                                                                                                                              • UnhandledExceptionFilter.KERNEL32(?), ref: 00C51952
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 254469556-0
                                                                                                                                                                                              • Opcode ID: 0fe95979945f3f332823035a402aa63dfd0bc23381a5e23842268f94392c18da
                                                                                                                                                                                              • Instruction ID: e16d9f389595aa138c5f1dac531d71fa13c8dfcde42278c6d0e1a72ed6bbff6a
                                                                                                                                                                                              • Opcode Fuzzy Hash: 0fe95979945f3f332823035a402aa63dfd0bc23381a5e23842268f94392c18da
                                                                                                                                                                                              • Instruction Fuzzy Hash: 67311A79D013189BDB21DF64D9897CCBBB8AF08341F10409AE80DAB290EBB05BC8DF55
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C5341B Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 172 c5341b-c53446 call c53fd9 175 c5344c-c5344f 172->175 176 c537bf-c537c4 call c5548a 172->176 175->176 177 c53455-c5345e 175->177 179 c53464-c53468 177->179 180 c5355b-c53561 177->180 179->180 182 c5346e-c53475 179->182 183 c53569-c53577 180->183 184 c53477-c5347e 182->184 185 c5348d-c53492 182->185 186 c5357d-c53581 183->186 187 c53728-c5372b 183->187 184->185 189 c53480-c53487 184->189 185->180 192 c53498-c534a0 call c524e3 185->192 186->187 188 c53587-c5358e 186->188 190 c5372d-c53730 187->190 191 c5374e-c53757 call c524e3 187->191 193 c535a6-c535ac 188->193 194 c53590-c53597 188->194 189->180 189->185 190->176 196 c53736-c5374b call c537c5 190->196 191->176 206 c53759-c5375d 191->206 205 c534a6-c534bf call c524e3 * 2 192->205 192->206 201 c536c4-c536c8 193->201 202 c535b2-c535d9 call c5288c 193->202 194->193 199 c53599-c535a0 194->199 196->191 199->187 199->193 208 c536d4-c536e0 201->208 209 c536ca-c536d3 call c52170 201->209 202->201 217 c535df-c535e2 202->217 205->176 230 c534c5-c534cb 205->230 208->191 213 c536e2-c536e6 208->213 209->208 214 c536f8-c53700 213->214 215 c536e8-c536f0 213->215 220 c53717-c53724 call c53e94 214->220 221 c53702-c53715 call c524e3 * 2 214->221 215->191 219 c536f2-c536f6 215->219 223 c535e5-c535fa 217->223 219->191 219->214 237 c53726 220->237 238 c53783-c53798 call c524e3 * 2 220->238 245 c5375e call c553ce 221->245 227 c536a5-c536b8 223->227 228 c53600-c53603 223->228 227->223 231 c536be-c536c1 227->231 228->227 233 c53609-c53611 228->233 235 c534f7-c534ff call c524e3 230->235 236 c534cd-c534d1 230->236 231->201 233->227 239 c53617-c5362b 233->239 257 c53501-c53521 call c524e3 * 2 call c53e94 235->257 258 c53563-c53566 235->258 236->235 241 c534d3-c534da 236->241 237->191 267 c5379d-c537ba call c52a7f call c53d94 call c53f51 call c53d0b 238->267 268 c5379a 238->268 242 c5362e-c5363e 239->242 246 c534dc-c534e3 241->246 247 c534ee-c534f1 241->247 248 c53666-c53673 242->248 249 c53640-c53653 call c538fb 242->249 262 c53763-c5377e call c52170 call c53aa6 call c54086 245->262 246->247 255 c534e5-c534ec 246->255 247->176 247->235 248->242 253 c53675 248->253 264 c53655-c5365b 249->264 265 c53677-c5369f call c5339b 249->265 261 c536a2 253->261 255->235 255->247 257->258 285 c53523-c53528 257->285 258->183 261->227 262->238 264->249 270 c5365d-c53663 264->270 265->261 267->176 268->267 270->248 285->245 287 c5352e-c53541 call c53afb 285->287 287->262 292 c53547-c53553 287->292 292->245 293 c53559 292->293 293->287
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • IsInExceptionSpec.LIBVCRUNTIME ref: 00C53518
                                                                                                                                                                                              • type_info::operator==.LIBVCRUNTIME ref: 00C5353A
                                                                                                                                                                                              • ___TypeMatch.LIBVCRUNTIME ref: 00C53649
                                                                                                                                                                                              • IsInExceptionSpec.LIBVCRUNTIME ref: 00C5371B
                                                                                                                                                                                              • _UnwindNestedFrames.LIBCMT ref: 00C5379F
                                                                                                                                                                                              • CallUnexpected.LIBVCRUNTIME ref: 00C537BA
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                              • API String ID: 2123188842-393685449
                                                                                                                                                                                              • Opcode ID: f7eefff87f91980eda96d692989b06fd72f90e159f4c1e260981ecabb0254bea
                                                                                                                                                                                              • Instruction ID: 70e009065d135a6c65cac11bcd089c6a0da68f900bf6c0b607d16c3e2c77d966
                                                                                                                                                                                              • Opcode Fuzzy Hash: f7eefff87f91980eda96d692989b06fd72f90e159f4c1e260981ecabb0254bea
                                                                                                                                                                                              • Instruction Fuzzy Hash: 20B17FB9C00249EFCF29DF94C9819AEBBB5FF08392B144059EC106B211D731DB99DB99
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C51FA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 294 c51fa0-c51ff1 call c5d040 call c51f60 call c52497 301 c51ff3-c52005 294->301 302 c5204d-c52050 294->302 303 c52007-c5201e 301->303 304 c52070-c52079 301->304 302->304 305 c52052-c5205f call c52480 302->305 306 c52034 303->306 307 c52020-c5202e call c52420 303->307 309 c52064-c5206d call c51f60 305->309 311 c52037-c5203c 306->311 316 c52044-c5204b 307->316 317 c52030 307->317 309->304 311->303 314 c5203e-c52040 311->314 314->304 318 c52042 314->318 316->309 319 c52032 317->319 320 c5207a-c52083 317->320 318->309 319->311 321 c52085-c5208c 320->321 322 c520bd-c520cd call c52460 320->322 321->322 324 c5208e-c5209d call c5ce20 321->324 327 c520e1-c520fd call c51f60 call c52440 322->327 328 c520cf-c520de call c52480 322->328 332 c5209f-c520b7 324->332 333 c520ba 324->333 328->327 332->333 333->322
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 00C51FD7
                                                                                                                                                                                              • ___except_validate_context_record.LIBVCRUNTIME ref: 00C51FDF
                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 00C52068
                                                                                                                                                                                              • __IsNonwritableInCurrentImage.LIBCMT ref: 00C52093
                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 00C520E8
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                              • API String ID: 1170836740-1018135373
                                                                                                                                                                                              • Opcode ID: d0fd6da1a4872f79b7388c565d88022b71fe66cb46c05437815c64d24d9d9cda
                                                                                                                                                                                              • Instruction ID: ba2c3fcf9aef40f903830dbaca3ae53c29e7f0a7856956a0fb900e269b07a263
                                                                                                                                                                                              • Opcode Fuzzy Hash: d0fd6da1a4872f79b7388c565d88022b71fe66cb46c05437815c64d24d9d9cda
                                                                                                                                                                                              • Instruction Fuzzy Hash: 7F41E538A012189BCF14DF68C884B9EBBF5FF86316F148155EC155B392C731AE89CB95
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C524F1 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 340 c524f1-c524f8 341 c524fd-c52518 GetLastError call c527cc 340->341 342 c524fa-c524fc 340->342 345 c52531-c52533 341->345 346 c5251a-c5251c 341->346 347 c52577-c52582 SetLastError 345->347 346->347 348 c5251e-c5252f call c52807 346->348 348->345 351 c52535-c52545 call c554ce 348->351 354 c52547-c52557 call c52807 351->354 355 c52559-c52569 call c52807 351->355 354->355 360 c5256b-c5256d 354->360 361 c5256f-c52576 call c5540a 355->361 360->361 361->347
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00C524E8,00C5231C,00C51A34), ref: 00C524FF
                                                                                                                                                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00C5250D
                                                                                                                                                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00C52526
                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,00C524E8,00C5231C,00C51A34), ref: 00C52578
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3852720340-0
                                                                                                                                                                                              • Opcode ID: aec5fd620f2b518ed0edc4d31ee2f98efb5012ff48b9f900aa5ccbfe51478d84
                                                                                                                                                                                              • Instruction ID: 81a8a8b6cfbfaaf25ff5dba954048d86f386ff756c4f2ba1d6a9947ebf7a8abb
                                                                                                                                                                                              • Opcode Fuzzy Hash: aec5fd620f2b518ed0edc4d31ee2f98efb5012ff48b9f900aa5ccbfe51478d84
                                                                                                                                                                                              • Instruction Fuzzy Hash: CF01F53F11A7225DA62927B5BCD572E2ED5DB037B77200239FE30500E0FB514DC86148
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C52673 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 364 c52673-c5267d 365 c526ee-c526f1 364->365 366 c526f3 365->366 367 c5267f-c5268c 365->367 368 c526f5-c526f9 366->368 369 c52695-c526b1 LoadLibraryExW 367->369 370 c5268e-c52691 367->370 373 c526b3-c526bc GetLastError 369->373 374 c526fa-c52700 369->374 371 c52693 370->371 372 c52709-c5270b 370->372 376 c526eb 371->376 372->368 377 c526e6-c526e9 373->377 378 c526be-c526d3 call c55708 373->378 374->372 375 c52702-c52703 FreeLibrary 374->375 375->372 376->365 377->376 378->377 381 c526d5-c526e4 LoadLibraryExW 378->381 381->374 381->377
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,00C52734,?,?,00C64C80,00000000,?,00C5285F,00000004,InitializeCriticalSectionEx,00C5ECBC,InitializeCriticalSectionEx,00000000), ref: 00C52703
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FreeLibrary
                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                              • API String ID: 3664257935-2084034818
                                                                                                                                                                                              • Opcode ID: 636424d3c73e1b9c03d1a68904fc780b57c2e999e6559894b903078192db4793
                                                                                                                                                                                              • Instruction ID: 1893da4ca3fc24a4a5e531f7d8519bd85eb458104edc10279b8e98ca999ba44b
                                                                                                                                                                                              • Opcode Fuzzy Hash: 636424d3c73e1b9c03d1a68904fc780b57c2e999e6559894b903078192db4793
                                                                                                                                                                                              • Instruction Fuzzy Hash: E811A73DA01621EBDF314B699C80B5E77E4AB06772F150110FD21F72C0DA70EE889AD9
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C54C74 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,F2ED4559,?,?,00000000,00C5D10F,000000FF,?,00C54C47,00C54D34,?,00C54C1B,00000000), ref: 00C54CA9
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00C54CBB
                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,00000000,00C5D10F,000000FF,?,00C54C47,00C54D34,?,00C54C1B,00000000), ref: 00C54CDD
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                              • Opcode ID: d1dce320c0a2620c53a09b72eb51205b988595ad39035111ca8a6d6c4e7b1f2e
                                                                                                                                                                                              • Instruction ID: bab8ce253303cf8bc8699502aeb1a354ca15f9f6624e51486d32c668acb8f62c
                                                                                                                                                                                              • Opcode Fuzzy Hash: d1dce320c0a2620c53a09b72eb51205b988595ad39035111ca8a6d6c4e7b1f2e
                                                                                                                                                                                              • Instruction Fuzzy Hash: DE01DB39500725EFDB199F50DD05FAE7BB8FB44B16F000125FC11A26D0D7B49A84DB55
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C59720 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • __alloca_probe_16.LIBCMT ref: 00C597A7
                                                                                                                                                                                              • __alloca_probe_16.LIBCMT ref: 00C59868
                                                                                                                                                                                              • __freea.LIBCMT ref: 00C598CF
                                                                                                                                                                                                • Part of subcall function 00C579A2: HeapAlloc.KERNEL32(00000000,00C56B72,00C588AA,?,00C56B72,00000220,?,?,00C588AA), ref: 00C579D4
                                                                                                                                                                                              • __freea.LIBCMT ref: 00C598E4
                                                                                                                                                                                              • __freea.LIBCMT ref: 00C598F4
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: __freea$__alloca_probe_16$AllocHeap
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1096550386-0
                                                                                                                                                                                              • Opcode ID: 4dc88e25ab4965a99e9f5fcc81361e8b71f83d5ced4f5ee80173aa05c56897e3
                                                                                                                                                                                              • Instruction ID: fa5f8e06ff937c39d11aee40718e570bc44d89bf917af479e23a0c9cb1f24b76
                                                                                                                                                                                              • Opcode Fuzzy Hash: 4dc88e25ab4965a99e9f5fcc81361e8b71f83d5ced4f5ee80173aa05c56897e3
                                                                                                                                                                                              • Instruction Fuzzy Hash: B751D47A600206EFEF105E61CC81EBB3AA9EF45352F150169FC14D6190E670CDD8D7A8
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C51000 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14libraryloaderCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories,00C5116C), ref: 00C5100A
                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00C51011
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AddressHandleModuleProc
                                                                                                                                                                                              • String ID: SetDefaultDllDirectories$kernel32.dll
                                                                                                                                                                                              • API String ID: 1646373207-2102062458
                                                                                                                                                                                              • Opcode ID: a8e09ecf8dc084afacef2060413e3b21b32174d93cf4531c9cc29dd8ce11ad21
                                                                                                                                                                                              • Instruction ID: cef51d575e8d2bd3691a5a9b6bdb31109db82259aab4c25b561f2b9ae371105b
                                                                                                                                                                                              • Opcode Fuzzy Hash: a8e09ecf8dc084afacef2060413e3b21b32174d93cf4531c9cc29dd8ce11ad21
                                                                                                                                                                                              • Instruction Fuzzy Hash: 45C01238340B0152DF281BB04E0D70F128C5A817C3F084460AD11E80E1DDB4C6C87527
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C59BEC Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetConsoleOutputCP.KERNEL32(F2ED4559,?,00000000,?), ref: 00C59C4F
                                                                                                                                                                                                • Part of subcall function 00C5708E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00C598C5,?,00000000,-00000008), ref: 00C5713A
                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00C59EAA
                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00C59EF2
                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00C59F95
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2112829910-0
                                                                                                                                                                                              • Opcode ID: f8e051e13d4ce9affe6b24322fd8d17a57c96a78a4f5d247f607ab3b3433a6bd
                                                                                                                                                                                              • Instruction ID: 7cc91975c8e81d22f2df099d91fd14f8776770bc2331474ea216a3f0fbb4548c
                                                                                                                                                                                              • Opcode Fuzzy Hash: f8e051e13d4ce9affe6b24322fd8d17a57c96a78a4f5d247f607ab3b3433a6bd
                                                                                                                                                                                              • Instruction Fuzzy Hash: C2D15979D04258DFCB15CFE8D880AADBBB5FF48301F28456AE826E7251D730A986CB54
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C531C4 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: AdjustPointer
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1740715915-0
                                                                                                                                                                                              • Opcode ID: 2153e5f68826727f803a583093c2185bbdc798baf11e6d5082184b19149f57ea
                                                                                                                                                                                              • Instruction ID: aa851b6d546ede805318fc32fa912ee91ce88d8539f744b90dca8c06ad0ad016
                                                                                                                                                                                              • Opcode Fuzzy Hash: 2153e5f68826727f803a583093c2185bbdc798baf11e6d5082184b19149f57ea
                                                                                                                                                                                              • Instruction Fuzzy Hash: B351D37A600A82AFDB298F51CC42B7A77A4EF04352F14412DEC15872A2D731EFC9D798
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C5B3A6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00C5AB66,?,00000001,?,?,?,00C59FE9,?,?,00000000), ref: 00C5B3BD
                                                                                                                                                                                              • GetLastError.KERNEL32(?,00C5AB66,?,00000001,?,?,?,00C59FE9,?,?,00000000,?,?,?,00C5A570,?), ref: 00C5B3C9
                                                                                                                                                                                                • Part of subcall function 00C5B38F: CloseHandle.KERNEL32(FFFFFFFE,00C5B3D9,?,00C5AB66,?,00000001,?,?,?,00C59FE9,?,?,00000000,?,?), ref: 00C5B39F
                                                                                                                                                                                              • ___initconout.LIBCMT ref: 00C5B3D9
                                                                                                                                                                                                • Part of subcall function 00C5B351: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00C5B380,00C5AB53,?,?,00C59FE9,?,?,00000000,?), ref: 00C5B364
                                                                                                                                                                                              • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00C5AB66,?,00000001,?,?,?,00C59FE9,?,?,00000000,?), ref: 00C5B3EE
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2744216297-0
                                                                                                                                                                                              • Opcode ID: cece813346f4cbfbe5955e54a997e158857bd94d86cdd317a675465e5c58f8d9
                                                                                                                                                                                              • Instruction ID: bab56efc0632f0672fdfcdc4b34238eaff727dd0cd70aea0d3e68db5d95df121
                                                                                                                                                                                              • Opcode Fuzzy Hash: cece813346f4cbfbe5955e54a997e158857bd94d86cdd317a675465e5c58f8d9
                                                                                                                                                                                              • Instruction Fuzzy Hash: DBF0A23A500254BBCF262F96DC04B9E3F66EB49372B044050FE19A5171DB72CEA4EB95
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00C537C5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00C537EA
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000000D.00000002.1704838684.0000000000C51000.00000020.00000001.01000000.00000010.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704809586.0000000000C50000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704875077.0000000000C5E000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704904578.0000000000C64000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000000D.00000002.1704947417.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_c50000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: EncodePointer
                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                              • API String ID: 2118026453-2084237596
                                                                                                                                                                                              • Opcode ID: 739b145f7cfcdffc58e60af9a3646c6aa6f81d4d8674528a0d281880f5d3dbab
                                                                                                                                                                                              • Instruction ID: da8d46904399d6fd16988573cd43cb6364105a8271f1c86f6988f033e739db16
                                                                                                                                                                                              • Opcode Fuzzy Hash: 739b145f7cfcdffc58e60af9a3646c6aa6f81d4d8674528a0d281880f5d3dbab
                                                                                                                                                                                              • Instruction Fuzzy Hash: A941AC76900249AFCF1ACF94CC81AEE7BB1FF08341F18805AFD1467251D3319A95DB98
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Callgraph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              • Opacity -> Relevance
                                                                                                                                                                                              • Disassembly available
                                                                                                                                                                                              callgraph 0 Function_00007FF6AA5239A0 1 Function_00007FF6AA521EA0 2 Function_00007FF6AA522F60 3 Function_00007FF6AA523CE0 4 Function_00007FF6AA523EE0 4->1 6 Function_00007FF6AA521F60 4->6 14 Function_00007FF6AA521DB0 4->14 17 Function_00007FF6AA521DF0 4->17 39 Function_00007FF6AA521D90 4->39 5 Function_00007FF6AA523960 7 Function_00007FF6AA523D70 8 Function_00007FF6AA523D30 9 Function_00007FF6AA523930 10 Function_00007FF6AA5232F0 10->8 11 Function_00007FF6AA523170 10->11 13 Function_00007FF6AA521F70 10->13 15 Function_00007FF6AA522030 10->15 18 Function_00007FF6AA522EB0 10->18 20 Function_00007FF6AA5228F0 10->20 21 Function_00007FF6AA522330 10->21 22 Function_00007FF6AA523E40 10->22 24 Function_00007FF6AA521080 10->24 33 Function_00007FF6AA5210C0 10->33 38 Function_00007FF6AA523B90 10->38 42 Function_00007FF6AA521050 10->42 44 Function_00007FF6AA523BD0 10->44 11->0 11->5 11->9 32 Function_00007FF6AA523040 11->32 43 Function_00007FF6AA5238D0 11->43 12 Function_00007FF6AA521030 13->8 13->22 28 Function_00007FF6AA523C80 13->28 13->44 15->0 15->3 15->22 25 Function_00007FF6AA523C00 15->25 26 Function_00007FF6AA523A00 15->26 15->44 16 Function_00007FF6AA521330 16->1 16->6 16->12 16->14 16->39 40 Function_00007FF6AA521E90 16->40 17->5 18->9 41 Function_00007FF6AA521AD0 18->41 19 Function_00007FF6AA522CF0 19->5 19->9 29 Function_00007FF6AA5236C0 19->29 30 Function_00007FF6AA523540 19->30 19->38 20->0 20->5 20->7 20->9 20->12 20->19 31 Function_00007FF6AA522200 20->31 35 Function_00007FF6AA522100 20->35 21->0 21->4 21->5 21->16 21->31 34 Function_00007FF6AA521CC0 21->34 21->35 36 Function_00007FF6AA524680 21->36 21->41 22->0 22->5 23 Function_00007FF6AA521000 23->10 27 Function_00007FF6AA523B00 30->5 32->0 32->2 33->7 37 Function_00007FF6AA5211C0 33->37 35->5 35->9 35->22 35->25 35->27 35->44

                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                              Function 00007FF6AA521330 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 266memorylibraryloaderCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 0 7ff6aa521330-7ff6aa521359 1 7ff6aa52135f-7ff6aa5213a0 GetProcAddress * 3 0->1 2 7ff6aa521691-7ff6aa5216c3 call 7ff6aa521030 ExpandEnvironmentStringsW 0->2 4 7ff6aa5213a7-7ff6aa5213b1 1->4 8 7ff6aa5216ce-7ff6aa5216e4 LoadLibraryW 2->8 9 7ff6aa5216c5-7ff6aa5216cc 2->9 6 7ff6aa5213b7-7ff6aa5213bf 4->6 7 7ff6aa521664-7ff6aa52167d 4->7 6->7 10 7ff6aa5213c5-7ff6aa5213c8 6->10 11 7ff6aa5216eb-7ff6aa5216ee 8->11 9->11 10->7 12 7ff6aa5213ce-7ff6aa5213df lstrlenW 10->12 11->1 15 7ff6aa5216f4-7ff6aa521718 ExpandEnvironmentStringsW 11->15 13 7ff6aa5213f1-7ff6aa5213f4 12->13 14 7ff6aa5213e1-7ff6aa5213e6 12->14 17 7ff6aa5213fa-7ff6aa521431 WideCharToMultiByte 13->17 18 7ff6aa52163e-7ff6aa521640 13->18 14->13 16 7ff6aa5213e8-7ff6aa5213ef 14->16 19 7ff6aa52171a-7ff6aa521721 15->19 20 7ff6aa521723-7ff6aa521739 LoadLibraryExW 15->20 16->13 16->14 22 7ff6aa521480-7ff6aa5214b1 WideCharToMultiByte 17->22 23 7ff6aa521433-7ff6aa521451 GetProcessHeap HeapAlloc 17->23 18->7 21 7ff6aa521740-7ff6aa521743 19->21 20->21 21->1 24 7ff6aa521749-7ff6aa52176d ExpandEnvironmentStringsW 21->24 26 7ff6aa5214b7-7ff6aa5214dd GetProcessHeap HeapAlloc 22->26 27 7ff6aa521642-7ff6aa521644 22->27 23->22 25 7ff6aa521453-7ff6aa52147d WideCharToMultiByte 23->25 28 7ff6aa521778-7ff6aa52178e LoadLibraryExW 24->28 29 7ff6aa52176f-7ff6aa521776 24->29 25->22 26->27 30 7ff6aa5214e3-7ff6aa52150f WideCharToMultiByte 26->30 31 7ff6aa521649-7ff6aa52164c 27->31 33 7ff6aa521795-7ff6aa521798 28->33 29->33 34 7ff6aa52151a-7ff6aa52151d 30->34 35 7ff6aa521511-7ff6aa521514 30->35 31->7 32 7ff6aa52164e-7ff6aa521662 GetProcessHeap HeapFree 31->32 32->7 33->1 36 7ff6aa52179e-7ff6aa5217a5 33->36 37 7ff6aa521523-7ff6aa521593 34->37 38 7ff6aa521624 34->38 35->34 36->4 37->38 41 7ff6aa521599-7ff6aa52160a call 7ff6aa521d90 37->41 39 7ff6aa521626-7ff6aa52163c GetProcessHeap HeapFree 38->39 39->31 46 7ff6aa52160c-7ff6aa521614 call 7ff6aa521f60 FlushFileBuffers 41->46 47 7ff6aa52167e-7ff6aa521685 call 7ff6aa521e90 41->47 53 7ff6aa52161a-7ff6aa52161d call 7ff6aa521db0 46->53 52 7ff6aa521687-7ff6aa52168f call 7ff6aa521ea0 47->52 47->53 52->53 57 7ff6aa521622 53->57 57->39
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Heap$ByteCharMultiProcessWide$AddressEnvironmentExpandLibraryLoadProcStrings$AllocFree$BuffersFileFlushlstrlen
                                                                                                                                                                                              • String ID: %SYSTEMROOT%\system32\cabinet.dll$%WINDIR%\system32\cabinet.dll$C:\Windows\system32\cabinet.dll$FDICopy$FDICreate$FDIDestroy$MZx
                                                                                                                                                                                              • API String ID: 3409977574-3837671842
                                                                                                                                                                                              • Opcode ID: be8b20edd14dbf0bc7b8464e5ab653c9d39fe3ab5a57a864b2ff5d75a87a05d8
                                                                                                                                                                                              • Instruction ID: 7252f8a5928d5472343efabe436a0e8ea1ee970006d5056eaa4be2af3e3c6dfa
                                                                                                                                                                                              • Opcode Fuzzy Hash: be8b20edd14dbf0bc7b8464e5ab653c9d39fe3ab5a57a864b2ff5d75a87a05d8
                                                                                                                                                                                              • Instruction Fuzzy Hash: 9FC14371E0AA42C1FA14CF51E85437A6791BF9A790F4441F6D94EC7AA4EF3CE14E8708
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA5211C0 Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 105stringCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: lstrcmpi$ArgvCommandEnvironmentLineVariable
                                                                                                                                                                                              • String ID: --chrome-beta$--chrome-dev$--chrome-frame$--chrome-sxs$--cleanup$--system-level$BraveSoftwareUpdateIsMachine${103BD053-949B-43A8-9120-2E424887DE11}${C6CB981E-DB30-4876-8639-109F8933582C}${CB2150F2-595F-4633-891A-E39720CE0531}
                                                                                                                                                                                              • API String ID: 310715562-1446311126
                                                                                                                                                                                              • Opcode ID: 53ad3257636432027177a422d5388deec34048ab42b9b14594bb3d1845c2475f
                                                                                                                                                                                              • Instruction ID: c075fbe5a1ee91cfe01bcb66a8f6fdf83177bf288a4755d00640f28cd40f2686
                                                                                                                                                                                              • Opcode Fuzzy Hash: 53ad3257636432027177a422d5388deec34048ab42b9b14594bb3d1845c2475f
                                                                                                                                                                                              • Instruction Fuzzy Hash: D5414136A0A606D4EB21CF16E84417A67A4BB56784F9480F7EA4DC73A0DF7CD54AC308
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA521AD0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 122fileCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Handle$File$CloseInformation$CreateErrorLast$Sleep
                                                                                                                                                                                              • String ID: MZx
                                                                                                                                                                                              • API String ID: 1461999944-2575928145
                                                                                                                                                                                              • Opcode ID: fae700a5440509070e2741754b0b6822c2ebe808603f7c74cfe8dde0de059789
                                                                                                                                                                                              • Instruction ID: 052438f383705229a57051033a79c46daf42d571a459dfa0a57e381df30eabc4
                                                                                                                                                                                              • Opcode Fuzzy Hash: fae700a5440509070e2741754b0b6822c2ebe808603f7c74cfe8dde0de059789
                                                                                                                                                                                              • Instruction Fuzzy Hash: 0241D231E0A542C1F7658F2AA80473A22A0BF867A4F5442F6ED5E837D0EF3D954B8704
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA5210C0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 72COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Resource$CommandFindFreeLineLoadLocalLockSizeof
                                                                                                                                                                                              • String ID: ChromeInstallerCleanup$MZx$Software\Microsoft\Windows\CurrentVersion\Uninstall\Brave${AFE6A462-C574-4B8A-AF43-4CC60DF4563B}
                                                                                                                                                                                              • API String ID: 1366880580-2760568576
                                                                                                                                                                                              • Opcode ID: 2d46261c93426bf2f99bf674c8bff4b3dea4a330985bd11e95d9aa9241824642
                                                                                                                                                                                              • Instruction ID: d8cb8a19b46427cd24f7ab196409b3626c35c76b1372d744365e5092d9c5d25f
                                                                                                                                                                                              • Opcode Fuzzy Hash: 2d46261c93426bf2f99bf674c8bff4b3dea4a330985bd11e95d9aa9241824642
                                                                                                                                                                                              • Instruction Fuzzy Hash: DA213231A07742C5EE609F11E9053BA63A0BF46B90F4481BACE4E87794EF7DE54AC304
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA522330 Relevance: 13.8, APIs: 2, Strings: 7, Instructions: 339COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 112 7ff6aa522330-7ff6aa522375 call 7ff6aa524680 call 7ff6aa523960 117 7ff6aa522469 112->117 118 7ff6aa52237b-7ff6aa522393 call 7ff6aa5239a0 112->118 119 7ff6aa522470-7ff6aa522486 117->119 118->117 122 7ff6aa522399-7ff6aa52241b call 7ff6aa521cc0 118->122 125 7ff6aa52241d 122->125 126 7ff6aa52242c-7ff6aa522432 122->126 127 7ff6aa522421 125->127 126->125 128 7ff6aa522434-7ff6aa52244e call 7ff6aa523960 126->128 129 7ff6aa522427-7ff6aa52242a 127->129 128->117 132 7ff6aa522450-7ff6aa522467 call 7ff6aa5239a0 128->132 129->119 132->117 135 7ff6aa522487-7ff6aa522496 call 7ff6aa523ee0 132->135 138 7ff6aa522498-7ff6aa52249e GetLastError 135->138 139 7ff6aa5224a0-7ff6aa5224ae 135->139 138->127 140 7ff6aa522586-7ff6aa5225bd call 7ff6aa521cc0 139->140 141 7ff6aa5224b4-7ff6aa5224c6 call 7ff6aa523960 139->141 147 7ff6aa5225bf 140->147 148 7ff6aa5225ce-7ff6aa5225d4 140->148 141->117 146 7ff6aa5224c8-7ff6aa5224df call 7ff6aa5239a0 141->146 146->117 154 7ff6aa5224e1-7ff6aa5224f0 call 7ff6aa523ee0 146->154 150 7ff6aa5225c3-7ff6aa5225c9 147->150 148->147 151 7ff6aa5225d6-7ff6aa5225e8 call 7ff6aa523960 148->151 150->129 151->117 157 7ff6aa5225ee-7ff6aa522605 call 7ff6aa5239a0 151->157 160 7ff6aa5224f6-7ff6aa52254d call 7ff6aa522100 154->160 161 7ff6aa522620-7ff6aa522626 GetLastError 154->161 157->117 164 7ff6aa52260b-7ff6aa52261a call 7ff6aa523ee0 157->164 168 7ff6aa52278e-7ff6aa5227a9 call 7ff6aa5239a0 160->168 169 7ff6aa522553-7ff6aa52255e 160->169 161->150 164->161 170 7ff6aa522727-7ff6aa52274b call 7ff6aa521330 call 7ff6aa521ad0 164->170 182 7ff6aa5227ab-7ff6aa5227c7 call 7ff6aa5239a0 168->182 183 7ff6aa522780-7ff6aa522789 168->183 172 7ff6aa522628-7ff6aa522632 169->172 173 7ff6aa522564 169->173 192 7ff6aa522750-7ff6aa52275d 170->192 174 7ff6aa52263c-7ff6aa522640 172->174 177 7ff6aa522568-7ff6aa52256e 173->177 180 7ff6aa522642-7ff6aa522649 174->180 181 7ff6aa522634-7ff6aa522638 174->181 178 7ff6aa52268f-7ff6aa522692 177->178 179 7ff6aa522574-7ff6aa52257c 177->179 189 7ff6aa5226d1-7ff6aa5226f3 call 7ff6aa521ad0 178->189 190 7ff6aa522694-7ff6aa5226cd call 7ff6aa522200 178->190 179->177 186 7ff6aa52257e-7ff6aa522581 179->186 180->181 187 7ff6aa52264b-7ff6aa52264e 180->187 181->174 182->183 202 7ff6aa5227c9-7ff6aa5227e4 call 7ff6aa5239a0 182->202 186->187 187->178 194 7ff6aa522650-7ff6aa522656 187->194 205 7ff6aa5226f7-7ff6aa5226fa 189->205 206 7ff6aa5226f5 189->206 190->189 197 7ff6aa52275f 192->197 198 7ff6aa522761-7ff6aa522768 192->198 200 7ff6aa522658-7ff6aa52265b 194->200 201 7ff6aa52267a-7ff6aa52268a call 7ff6aa5239a0 194->201 197->198 203 7ff6aa52270b-7ff6aa52270e 198->203 204 7ff6aa52276a-7ff6aa52277e call 7ff6aa523960 198->204 200->201 207 7ff6aa52265d-7ff6aa522678 call 7ff6aa5239a0 200->207 201->178 202->183 215 7ff6aa5227e6-7ff6aa522801 call 7ff6aa5239a0 202->215 203->119 204->203 212 7ff6aa5226fc 205->212 213 7ff6aa522713-7ff6aa522725 call 7ff6aa523960 205->213 206->205 207->178 207->201 217 7ff6aa522701-7ff6aa522708 212->217 213->217 215->183 223 7ff6aa522807-7ff6aa522822 call 7ff6aa5239a0 215->223 217->203 223->183 226 7ff6aa522828-7ff6aa52283f call 7ff6aa5239a0 223->226 226->183 229 7ff6aa522845-7ff6aa522860 call 7ff6aa5239a0 226->229 229->183 232 7ff6aa522866-7ff6aa522881 call 7ff6aa5239a0 229->232 232->183 235 7ff6aa522887-7ff6aa5228a2 call 7ff6aa5239a0 232->235 235->183 238 7ff6aa5228a8-7ff6aa5228c1 call 7ff6aa5239a0 235->238 238->183 241 7ff6aa5228c7-7ff6aa5228e5 call 7ff6aa5239a0 238->241 241->169 244 7ff6aa5228eb 241->244 244->183
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000000,MZx,?,?,?,?,?,00007FF6AA523447), ref: 00007FF6AA522498
                                                                                                                                                                                                • Part of subcall function 00007FF6AA521CC0: EnumResourceNamesW.KERNEL32 ref: 00007FF6AA521CD7
                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000000,MZx,?,?,?,?,?,00007FF6AA523447), ref: 00007FF6AA522620
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ErrorLast$EnumNamesResource
                                                                                                                                                                                              • String ID: " --$MZx$new-setup-exe$setup.exe$update-setup-exe$x$y
                                                                                                                                                                                              • API String ID: 737610517-3588629935
                                                                                                                                                                                              • Opcode ID: d9ad8f4864f80caf256cc396abaedb767386b065065cf90ebfa344b5a7b182d2
                                                                                                                                                                                              • Instruction ID: 204cb2d6636832dd59aa8f05c8f6bb3d9f9b9957b4a4cb4b06deaacff6826bf8
                                                                                                                                                                                              • Opcode Fuzzy Hash: d9ad8f4864f80caf256cc396abaedb767386b065065cf90ebfa344b5a7b182d2
                                                                                                                                                                                              • Instruction Fuzzy Hash: 06E18BB6A0E682C1EA608F10D1403FA6351EF96784F9441F3DA8D87A95DE3CE58FC749
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA523170 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 103COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CreateDirectoryErrorFreeFunction036LastLocalSystem
                                                                                                                                                                                              • String ID: .tmp$CR_$MZx
                                                                                                                                                                                              • API String ID: 1732257400-2866166633
                                                                                                                                                                                              • Opcode ID: 718a5a7b2bd421c5ee3395f2823bb4f15cc6c72c6dfe0933d8db1a6e6d74d35e
                                                                                                                                                                                              • Instruction ID: 0bfb0cd0ed0fdde6ea81bbb949c15c709c6dc1a7b2543ae57df6863cc82d1d78
                                                                                                                                                                                              • Opcode Fuzzy Hash: 718a5a7b2bd421c5ee3395f2823bb4f15cc6c72c6dfe0933d8db1a6e6d74d35e
                                                                                                                                                                                              • Instruction Fuzzy Hash: 3F319FA2B0A642D1FA149F11E9407F96651AF87BE0F5481F2EE9D87781DE3CD58BC208
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA522200 Relevance: 12.1, APIs: 8, Instructions: 78processsynchronizationCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CloseErrorHandleLastProcess$AttributesCodeCreateExitFileObjectSingleWait
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 1236864362-0
                                                                                                                                                                                              • Opcode ID: 7bcea0aa7e1654ef5787a63bae3990c0f6ce7ce81792a7877ab6c3b4acd2fa63
                                                                                                                                                                                              • Instruction ID: 722ad212cce766e0f765fa6d0fabe4ba9ce5073c5d3c09c63ff06c5a9c7455a0
                                                                                                                                                                                              • Opcode Fuzzy Hash: 7bcea0aa7e1654ef5787a63bae3990c0f6ce7ce81792a7877ab6c3b4acd2fa63
                                                                                                                                                                                              • Instruction Fuzzy Hash: 9B318F32919A81C6E7208F19F8447BAB7A1FF89754F4481B5EA8D83754EF3DD18ACB00
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA522F60 Relevance: 12.1, APIs: 8, Instructions: 63memoryCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Token$InformationLocalProcess$AllocCloseCurrentErrorFreeHandleLastOpen
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3439255530-0
                                                                                                                                                                                              • Opcode ID: f30d9c696816cdab1ec3a17349200a718af0a1d3f92af8fe297077335a5cac70
                                                                                                                                                                                              • Instruction ID: 2f829d85f37394e4883efb1aac9f4c82ed7684b97de332eb67c34e86195a28b1
                                                                                                                                                                                              • Opcode Fuzzy Hash: f30d9c696816cdab1ec3a17349200a718af0a1d3f92af8fe297077335a5cac70
                                                                                                                                                                                              • Instruction Fuzzy Hash: 2721532661A542C2F7608F25E804B7A6360BFC6B50F5440F6DE4E93A54DF3CD54BCB08
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA5232F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Resource$Process$CommandCurrentErrorFileFindFreeLastLineLoadLocalLockModuleNameSizeSizeofWorking
                                                                                                                                                                                              • String ID: InstallerExtraCode1
                                                                                                                                                                                              • API String ID: 737911292-2381712892
                                                                                                                                                                                              • Opcode ID: c82f74817944ddf96d7ce53b1880ed3ad3951705bc266c036080728ebeb932f7
                                                                                                                                                                                              • Instruction ID: 2d8e00350115d407423687878b62edd924eea5810c7d89a07caca96d81b75eba
                                                                                                                                                                                              • Opcode Fuzzy Hash: c82f74817944ddf96d7ce53b1880ed3ad3951705bc266c036080728ebeb932f7
                                                                                                                                                                                              • Instruction Fuzzy Hash: F551963261D686C1D7209F15E5443AE6360EF827A0F4451B2EB9D836D9DF7CD14ACB08
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA523040 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              • D:PAI(A;;FA;;;BA)(A;OIIOCI;GA;;;BA)(A;;FA;;;SY)(A;OIIOCI;GA;;;SY)(A;OIIOCI;GA;;;CO)(A;;FA;;;, xrefs: 00007FF6AA5230E9
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: InformationProcessTokenVolume$CloseCurrentErrorFreeHandleLastLocalNameOpenPath
                                                                                                                                                                                              • String ID: D:PAI(A;;FA;;;BA)(A;OIIOCI;GA;;;BA)(A;;FA;;;SY)(A;OIIOCI;GA;;;SY)(A;OIIOCI;GA;;;CO)(A;;FA;;;
                                                                                                                                                                                              • API String ID: 3974508999-3878039831
                                                                                                                                                                                              • Opcode ID: 5c11e7c16573a4bb4193614ac1268811fa8dea902af8f6831b8809c4acb0594e
                                                                                                                                                                                              • Instruction ID: 6346641e95f3154f82a4ec34896d603bc221a196bb65825a8413592c447e2150
                                                                                                                                                                                              • Opcode Fuzzy Hash: 5c11e7c16573a4bb4193614ac1268811fa8dea902af8f6831b8809c4acb0594e
                                                                                                                                                                                              • Instruction Fuzzy Hash: 6B316B32A19682C2E7508F20E8043AA6361EF97754F6441B6DB8DC7A94DF3ED50BC708
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA523EE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73fileCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ErrorFileLast$CloseCreateHandleWrite
                                                                                                                                                                                              • String ID: MZx
                                                                                                                                                                                              • API String ID: 4031202350-2575928145
                                                                                                                                                                                              • Opcode ID: 65bcba183f1d48a4549787194f40878cefec275a29e5551b014b0886b67b6e08
                                                                                                                                                                                              • Instruction ID: 2ef4fbd34db5c63881dd2c9ab8282ffb4d26beeaca114873712289b697541523
                                                                                                                                                                                              • Opcode Fuzzy Hash: 65bcba183f1d48a4549787194f40878cefec275a29e5551b014b0886b67b6e08
                                                                                                                                                                                              • Instruction Fuzzy Hash: 24219222B1A451D2EA109F12E9047BBA351BB4ABD8F8800F6EE5E87785DE3CD50FC744
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA523E40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47registryCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CloseOpen
                                                                                                                                                                                              • String ID: MZx$Software\BraveSoftware\Update\ClientState\
                                                                                                                                                                                              • API String ID: 47109696-1006479344
                                                                                                                                                                                              • Opcode ID: 0bf115a699aec88be2570a626c41529b181763eb6068d79b65174ffdd59f7d96
                                                                                                                                                                                              • Instruction ID: f17f45760880a18275eb4e7dcb94ed5dbd14d08527d73a6d291cbe39c27711e9
                                                                                                                                                                                              • Opcode Fuzzy Hash: 0bf115a699aec88be2570a626c41529b181763eb6068d79b65174ffdd59f7d96
                                                                                                                                                                                              • Instruction Fuzzy Hash: D301F526B1A64181F761CF91E8443B62351AF46790F4441B2EE5D97781EE3CD44E8344
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA523CE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registrystringCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 490 7ff6aa523ce0-7ff6aa523d26 lstrlenW RegSetValueExW
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Valuelstrlen
                                                                                                                                                                                              • String ID: MZx
                                                                                                                                                                                              • API String ID: 799288031-2575928145
                                                                                                                                                                                              • Opcode ID: eef66df1a55e0406f6d32addfd628c4762235853b8982a6a9ae0fcce0f669e5e
                                                                                                                                                                                              • Instruction ID: f8de3fa7ab9f1334e158035ccd2e7591c1a611c43b41c3be2854b9bf446603bc
                                                                                                                                                                                              • Opcode Fuzzy Hash: eef66df1a55e0406f6d32addfd628c4762235853b8982a6a9ae0fcce0f669e5e
                                                                                                                                                                                              • Instruction Fuzzy Hash: AEE0DF36B1856085F7209F2AF808A696660A7DDFE4F088071DD4C83B68DE2CC18B8B00
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA523D70 Relevance: 4.6, APIs: 3, Instructions: 60registryCOMMON
                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                              • Executed
                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                              control_flow_graph 491 7ff6aa523d70-7ff6aa523da3 RegOpenKeyExW 492 7ff6aa523dc1-7ff6aa523dff RegQueryValueExW 491->492 493 7ff6aa523da5-7ff6aa523dad 491->493 492->493 494 7ff6aa523e01-7ff6aa523e06 492->494 495 7ff6aa523daf RegCloseKey 493->495 496 7ff6aa523db5-7ff6aa523dc0 493->496 494->493 497 7ff6aa523e08-7ff6aa523e10 494->497 495->496 498 7ff6aa523e29 497->498 499 7ff6aa523e12-7ff6aa523e1d 497->499 501 7ff6aa523e2e-7ff6aa523e31 498->501 500 7ff6aa523e1f-7ff6aa523e24 499->500 499->501 502 7ff6aa523e36-7ff6aa523e38 500->502 503 7ff6aa523e26 500->503 501->493 502->493 503->498
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CloseOpenQueryValue
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3677997916-0
                                                                                                                                                                                              • Opcode ID: 913576f29219455dba437064464af603eabe837be3e84081c1b97da231c73675
                                                                                                                                                                                              • Instruction ID: 7c0952a523449a38074776108d2c4686ed58e876b36e203167df0cda2a951d6b
                                                                                                                                                                                              • Opcode Fuzzy Hash: 913576f29219455dba437064464af603eabe837be3e84081c1b97da231c73675
                                                                                                                                                                                              • Instruction Fuzzy Hash: 5621A533619641C6FB608F15E80076AA3A5FBC67A0F4441B6EA8DD3B94DF7CD44ACB04
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA523C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • RegQueryValueExW.KERNELBASE(?,?,?,?,MZx,?,00007FF6AA5220A6), ref: 00007FF6AA523C33
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: QueryValue
                                                                                                                                                                                              • String ID: MZx
                                                                                                                                                                                              • API String ID: 3660427363-2575928145
                                                                                                                                                                                              • Opcode ID: a70c7a76e5b8b6159f66a07447bfa7b2e76dbbbc6b5d8d2c4ce7cb94b1699c6c
                                                                                                                                                                                              • Instruction ID: 391e95a39d814df79b4779d2e7cd7a50a4905c9008a9d144ce32583802fd5345
                                                                                                                                                                                              • Opcode Fuzzy Hash: a70c7a76e5b8b6159f66a07447bfa7b2e76dbbbc6b5d8d2c4ce7cb94b1699c6c
                                                                                                                                                                                              • Instruction Fuzzy Hash: 2A01D432A1A545C2E7648F14E10566A73A0EFC1760F4481B3EB4A93AD4DF3CD44ACA04
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA521000 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 8COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Strings
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ExitProcess
                                                                                                                                                                                              • String ID: MZx
                                                                                                                                                                                              • API String ID: 621844428-2575928145
                                                                                                                                                                                              • Opcode ID: 0a848b0dd2127952284119b96377679ac836529e121bac861a9036ada258ffa9
                                                                                                                                                                                              • Instruction ID: bc8035647b18fca2498dae962996b4826eace01618c5bff1f800d78168e449aa
                                                                                                                                                                                              • Opcode Fuzzy Hash: 0a848b0dd2127952284119b96377679ac836529e121bac861a9036ada258ffa9
                                                                                                                                                                                              • Instruction Fuzzy Hash: 34C01225A19552C2F6149F14D4014A96321AF41754F4080B2D54D532259E2CA50BC704
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA521DF0 Relevance: 3.0, APIs: 2, Instructions: 36fileCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: CloseCreateFileHandle
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3498533004-0
                                                                                                                                                                                              • Opcode ID: a0da7f0cbcb8518973dac9d7c586c98ea94a7ca5d87cc395a8b497b6c15ab702
                                                                                                                                                                                              • Instruction ID: 013931b8c780beaaf3e1ca86460f935aea936b87bd07e27ff311dcd11b22ca75
                                                                                                                                                                                              • Opcode Fuzzy Hash: a0da7f0cbcb8518973dac9d7c586c98ea94a7ca5d87cc395a8b497b6c15ab702
                                                                                                                                                                                              • Instruction Fuzzy Hash: C9018F31A1564181F6608F24E8583A62650BB867F4F1443B5EBBA4B7E0DFBD848B8704
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA523D30 Relevance: 1.5, APIs: 1, Instructions: 12registryCOMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                              • Opcode ID: 8d47ce4adae051e16bff91fc4dcb9f69c1f9e74ce06b048ac4fc986741e11445
                                                                                                                                                                                              • Instruction ID: 1f24354c2da96514461f9b03640043cf952ab62faa51f0e9ebe093247c228199
                                                                                                                                                                                              • Opcode Fuzzy Hash: 8d47ce4adae051e16bff91fc4dcb9f69c1f9e74ce06b048ac4fc986741e11445
                                                                                                                                                                                              • Instruction Fuzzy Hash: F2D05E76615A80C6D3609F14E84570D3760F3C9B84F905010EB4C03B20CF3CC21ACF04
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                                                                              Function 00007FF6AA521DB0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                              APIs
                                                                                                                                                                                              • FindCloseChangeNotification.KERNELBASE(?,?,00000000,00007FF6AA523FBF), ref: 00007FF6AA521DD0
                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                              • Source File: 0000002E.00000002.2361733034.00007FF6AA521000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6AA520000, based on PE: true
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361702551.00007FF6AA520000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361767961.00007FF6AA525000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361818027.00007FF6AA528000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AA52A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              • Associated: 0000002E.00000002.2361858469.00007FF6AAF2A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                              • Snapshot File: hcaresult_46_2_7ff6aa520000_brave_installer-x64.jbxd
                                                                                                                                                                                              Similarity
                                                                                                                                                                                              • API ID: ChangeCloseFindNotification
                                                                                                                                                                                              • String ID:
                                                                                                                                                                                              • API String ID: 2591292051-0
                                                                                                                                                                                              • Opcode ID: 5e4e4560b8218055e5cd9b848970796ffe5649c193789c5f537aee99201477c3
                                                                                                                                                                                              • Instruction ID: c0c0b72828a275f6fb1d47bf1a8631fd8d4bba093b2f2f49ac27df970738fc2e
                                                                                                                                                                                              • Opcode Fuzzy Hash: 5e4e4560b8218055e5cd9b848970796ffe5649c193789c5f537aee99201477c3
                                                                                                                                                                                              • Instruction Fuzzy Hash: A0D0A933E04A85C2E3245F6AB8880B42220FF66734F1843B0D6BE463E0AFA808C78344
                                                                                                                                                                                              Uniqueness

                                                                                                                                                                                              Uniqueness Score: -1.00%